Security checks across malware telemetry and agentic risk
Canary is a disclosed local safety-monitoring helper, but users should treat it as advisory logging and checks, not a real sandbox or kill switch.
Install only if you want a lightweight local monitoring layer. Configure it with decoy tripwire paths, protect the log and .canary_tripwires directories, avoid clearing logs when audit history matters, and do not rely on Canary as a sandbox or process-level halt mechanism.
import subprocess
cmd_list = cmd.split() if isinstance(cmd, str) else cmd
return subprocess.run(cmd_list, capture_output=True)
```
### Pre-Deployment Checks- Requires manual review to restart **Tripwire Files:** - Create honeypot files that should never be accessed - Detect modifications, deletions, or access - Hash verification for file integrity
- **Use decoy paths only** — never point tripwires at real files containing sensitive data. Tripwires are honeypots; treat them as bait, not protection. - **`create_tripwire` will not overwrite existing files** — it checks for pre-existing files and refuses to proceed. Use dedicated empty paths for tripwires. - **Test in a sandbox first** — verify where logs, tripwires, and registry files are created before deploying. Confirm protected paths and auto-halt behavior in an isolated environment. - **Protect log and alert directories** — set filesystem permissions so alert logs are not world-readable. Canary writes plaintext logs; restrict access accordingly. - **Canary only blocks when called** — it is not an OS-level enforcement mechanism. Layer it with containers, filesystem permissions, and `auditd` for production deployments. ## ⚠️ Disclaimer
61/61 vendors flagged this skill as clean.