执行范围强制执行
sodejm2026-10-25查看 249复制 161
在执行时强制执行网络目的地和资源身份，以防止范围扩展和出口违规。
📘如何使用这个技能
- 1复制技能内容·点击上方「Copy SKILL.md」复制全部内容，或 Download 下载到本地
- 2打开你的 AI 客户端·支持 Claude Code、Trae、Cursor、ChatGPT、DeepSeek、Kimi 等任意 AI 助手
- 3粘贴为系统提示/知识文件·Claude Code：放入 .claude/skills/ 目录；普通对话：作为首条消息发送并说「请严格按这份技能文档执行」
- 4直接提出你的需求·AI 会按技能定义的工作流、格式和约束来处理，无需再解释背景
💡 提示：技能生效后，每次对话只需一句需求，AI 会按 SKILL.md 的流程执行。
SKILL.md1499 chars
---
name: execution-scope-enforcement
description: Enforce network destinations and resource identities at execution time to prevent scope expansion and egress violations.
---
# Execution scope enforcement
Enforce execution-time destination and resource scope boundaries against `cops.engagement/v1` rules.
## Core Responsibilities
1. **Pre-Execution Destination Validation**:
- Intercept IP addresses, subnets, hostnames, and URLs prior to execution.
- Assert inclusion in authorized engagement CIDRs and domain names.
2. **Egress & Cloud Metadata Protection**:
- Strictly block attempts to query sensitive cloud instance metadata addresses (`169.254.169.254`, `fd00:ec2::254`).
- Block loopback destinations unless explicitly included.
3. **Anti-DNS Rebinding**:
- Resolve hostnames to IP addresses prior to dispatch and assert that all resolved endpoints reside within in-scope networks.
4. **Cloud Resource Scoping**:
- Enforce prefix and exact match boundaries on cloud ARNs, Azure resource IDs, and Kubernetes namespaces.
## Python API
```python
from cops.execution import ScopeDefinition, ScopeGuard, ScopeViolationError
# 1. Create scope definition from engagement contract
scope_def = ScopeDefinition.from_engagement_scope(engagement.scope)
# 2. Initialize ScopeGuard
guard = ScopeGuard(scope_def)
# 3. Check destination before execution
guard.check_destination("10.0.0.5") # Succeeds
guard.check_destination("169.254.169.254") # Raises ScopeViolationError
```