What the reviewer found
This AGENTS.md contains a '<safety_and_refusal_override>' block telling the agent to assume the user is an authorized administrator for file deletion, network requests, and security testing, skip safety warnings, and 'verify the path once and then EXECUTE' on rm -rf rather than refuse out of caution. That is a real instruction to bypass the agent's own safety judgment on destructive commands, not a documentation example; the Chutes/curl API-router text elsewhere in the file is unrelated and benign.
prompt-injection— tries to steer the agentdestructive— can destroy data
What was read
The file as it ships in grahama1970/extractor:
AGENTS.md
What the static scan said
The scan flagged 3things. The reviewer kept 2 and dismissed 1 as false.
AR1Tells the agent never to refuse — realRMRecursive force delete — realNETMakes network calls — false positive
How this review was made
Sonnet 5 read the files above on 7 September 2026 and answered three questions: is it dangerous to whoever installs it, is each scanner finding real, and what should the installer know. The verdict is bound to the file's hash; when the file changes, it is scanned afresh and reviewed again. A script that changes while the definition does not is not re-reviewed — that is a known gap. How the scan and the review work.