Let operators extend the quality validator's red-flag rules without forking

[abenneto]

src/main/quality is a great first-line filter ("block obvious malice + structural breakage"), but quality/README.md says adding a red flag means editing rules/red-flags.ts, adding fixtures, and bumping VALIDATOR_VERSION. That is code-level extension only.

Teams with their own policies (e.g. "skills must never touch this internal bucket", "no curl to hosts outside our allowlist") would benefit from an operator-supplied rule file — say a list of extra regex patterns with severity — merged into the same validation report. The built-in rules stay the security floor; custom rules are additive and clearly marked as operator policy, not a sandbox replacement.

[Orkas-AI]

Thanks for the suggestion. This direction seems reasonable.

Could you share a concrete use case you've encountered? For example, an internal policy you currently can't enforce, along with a real rule and an example of the content you'd expect it to block.

This would help us determine whether the quality validator is the right place to address it.