Vulnerability Pre Action Diode

---
name: vulnerability-pre-action-diode
description: >
  WHOOP / The New Stack vulnerability triage elimination pattern is FORMAT,
  not a ThumbGate clone. Intercepts untrusted installs, pipe-to-bash, and
  unpinned supply-chain artifacts in PreToolUse (<5ms) instead of 3-day post-mortem
  triage. Calculates quantifiable enterprise ROI. Slash: /vulnerability-pre-action-diode.
---

# Vulnerability Pre-Action Diode — compare, do not clone

## Goal

Provide deterministic pre-action interdiction on agent dependency installations
and shell commands before execution occurs, eliminating the 96-hour post-facto
manual triage cycle reported in enterprise environments (WHOOP/TNS).

## Constraints

| NEVER | ALWAYS |
| --- | --- |
| Clone Datadog Bits AI or workflow orchestrators | Enforce deterministic PreToolUse diodes in <5ms |
| Allow pipe-to-bash (`curl \| bash`) | Block remote script pipes immediately |
| Allow plaintext `http://` package registries | Enforce HTTPS encrypted package endpoints |
| Allow untrusted package lifecycle scripts | Block `--ignore-scripts false` overrides |
| Claim fake MTTR savings | Cite the empirical 96-hour WHOOP/TNS benchmark |

## CLI Procedures

```bash
# Evaluate a tool call
node scripts/vulnerability-pre-action-diode.js --check="npm install express" --json

# Run enterprise ROI calculation
node scripts/triage-savings-calculator.js --vulnerabilities=4 --interdictions=24 --tier=enterprise --json

# Run unit tests
npm run test:vulnerability-diode
```

## Rubric

- critical violations (`pipe_to_bash`, `insecure_protocol_dependency`, `known_compromised_package`) return `verdict: 'block'`
- unpinned installs return `verdict: 'review'`
- pinned installs return `verdict: 'allow'`
- triage hours saved computed accurately ($125/hr blended rate)
- test suite passes: `npm run test:vulnerability-diode`