[Bug] False positive cyber classification during legitimate local plugin development inspection

Bug Description
False positive: legitimate coding work flagged as [cyber], forced a model switch from Fable 5.1 to Opus 4.8 mid-task.

I was inspecting a locally-installed Herdr sidebar plugin (herdr-agent-quota) to add a feature: reading how it collects subscription quota, grepping the local CLI binaries for the endpoint/schema it uses, and checking my own credential file's structure (key names only, no secret values). This is ordinary plugin development on my own machine, not an attack. The [cyber] classifier misread it and switched models, interrupting the task.

Please tune the [cyber] safeguard so authorized local dev/config inspection (own credentials, own machine) isn't caught.

Environment Info

• Platform: linux
• Terminal: WezTerm
• Version: 2.1.276
• Feedback ID: e81f52fe-eb43-457b-a007-b67111317643

Errors

[]

Start by reproducing the described local plugin, CLI binary, and credential-file inspection scenario, then trace the cyber classifier and model-switch path involved. Done means authorized local development inspection no longer produces a false positive while the safeguard still handles the cases it is intended to catch.