Docs / Rule reference
Every rule is deterministic and auditable
A rule id is always <prefix>.<name> — the prefix tells you the category, and every
category below maps to a real, readable check, not a black-box model. This page lists categories and
illustrative examples, not an exhaustive catalog — the full, current list ships with the engine itself and is
what pinkyai status reports a count against.
Security rule categories
| Category | Prefix | Example rule id |
|---|---|---|
| Secrets | secret | secret.aws_access_key |
| PII | pii | pii.email |
| Entropy / high-randomness tokens | entropy | entropy.high_randomness_string |
| Dangerous commands | dangerous_command | dangerous_command.rm_rf_broad_path |
| Prompt injection | injection | injection.ignore_previous_instructions |
| Package / supply-chain | package_check | package_check.typosquat_name |
| Malicious URLs | malicious_url | malicious_url.ip_literal_url |
Token-saving rules (prefix: token.*)
A separate set from the security categories above — these flag wasteful patterns (duplicate reads, oversized output, avoidable re-runs) rather than security risk. A few real examples:
- token.duplicate_tool_call — the same call already ran this session
- token.write_then_read — reading a file right after you wrote it
- token.repo_map_advisor — many single-file reads where a repo map would be cheaper
- token.large_inline_heredoc — a large inline shell heredoc where a file would be cheaper
Overriding a rule
Every rule can be overridden for a specific action, with a reason and a time-to-live — never silently, never permanently by accident.
pinkyai override "<command>" --reason "why" --ttl 10mNext: Troubleshooting →