shield-v0.md (example)

Purpose

Example threat feed for OAP integration demo. Converts to OAP policy pack and is verified via POST /api/verify/policy/IN_BODY.

Active threats (compressed)

---

id: T001
fingerprint: example-destructive-cmd
category: tool
severity: critical
confidence: 0.95
action: block
title: Destructive shell commands
recommendation_agent: BLOCK: command contains rm -rf
expires_at: null
revoked: false

---

Block commands containing rm -rf.

---

id: T002
fingerprint: example-sudo
category: tool
severity: high
confidence: 0.9
action: require_approval
title: Privilege escalation
recommendation_agent: APPROVE: command contains sudo
expires_at: null
revoked: false

---

Require approval for commands containing sudo.