Compound Modification + Network Risk

What Foo Guard detects

The agent can modify resources and communicate over arbitrary HTTP without a human approval boundary.

When this rule triggers

humanApprovalRequired is false and the agent combines resource modification with arbitrary HTTP capability.

Foo Guard evaluates the normalized configuration supplied to the scanner. A finding describes configuration risk; it does not establish that an attack occurred. An absent finding does not prove that an undeclared capability is safe.

How to fix

Review the combined workflow: narrow writes, restrict network destinations, and require approval for consequential operations. Individual tool reviews may miss the combined exposure.

Verify the change

Update the actual agent configuration and the underlying permissions or controls, then run the scanner again. Inspect the finding’s evidence path to confirm the intended setting changed. Do not clear a finding by changing a declaration that no longer reflects the deployed agent.