{
  "schema_version": 1,
  "id": "block-fetch-exec-in-files",
  "track": "coding",
  "name": "Flag Downloads Run as Code in Files",
  "version": "0.0.3",
  "sha256": "5bbae80a44b9d27a8ba1911c68af93caf09f718065dc83197b3adb99be9a514b",
  "sha256_v1": "97a35d16685ec292a2db6eca2fe9b90a9bb0230de9cd4eefae0b031e2c9feb80",
  "keyword": "warn",
  "word": "warns",
  "says": "warns on an agent's file writes and at turn end",
  "description": "Warns (observe rollout) when a line added to a script, Dockerfile, Makefile, CI workflow or package.json wires a download into a code runner: curl/wget/aria2c/lynx/iwr/irm piped into a shell, python/perl/ruby/node/php/lua on stdin, pwsh or iex; bash -c, eval, source or a here-string of a $(...) or <(...) download; Dockerfile ADD of a URL without --checksum. One line at a time: continuation lines, variables, unicode-escaped JSON, split or quoted command names, a download saved to a file and run on a later step, and interpreters or fetchers outside the lists are missed. Never refuses. Friction only.",
  "misses": null,
  "where": [
    "write",
    "turn-end"
  ],
  "groups": [
    "shell-containment"
  ],
  "eval_cases": 25,
  "eval_executed": 25,
  "latest": {
    "version": "0.0.3",
    "date": "2026-10-27",
    "change": "Title wording only (IR-F40): \"Flag Fetch-Exec in Files\" is now \"Flag Downloads Run as Code in Files\". The id, guard and tests are unchanged."
  },
  "agent_labels": {
    "claude-code": {
      "keyword": "warn",
      "says": "warns on an agent's file writes and at turn end"
    },
    "cursor": {
      "keyword": "warn",
      "says": "warns on an agent's file writes and at turn end"
    },
    "codex": {
      "keyword": "warn",
      "says": "warns on an agent's file writes and at turn end. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)"
    },
    "copilot": {
      "keyword": "warn",
      "says": "warns at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)"
    },
    "devin": {
      "keyword": "warn",
      "says": "warns at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed)"
    },
    "grok": {
      "keyword": "ungraded",
      "says": "Not graded yet for Grok"
    },
    "goose": {
      "keyword": "ungraded",
      "says": "Not graded yet for goose"
    },
    "antigravity": {
      "keyword": "ungraded",
      "says": "Not graded yet for Antigravity"
    },
    "openhands": {
      "keyword": "ungraded",
      "says": "Not graded yet for OpenHands"
    },
    "kimi-code": {
      "keyword": "ungraded",
      "says": "Not graded yet for Kimi Code"
    },
    "factory-droid": {
      "keyword": "ungraded",
      "says": "Not graded yet for Factory Droid"
    }
  },
  "source_url": "https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/block-fetch-exec-in-files",
  "enforces": "advisory",
  "examples": [
    {
      "word": "Warns",
      "prompt": "A commit adds a Dockerfile RUN step that pipes a download into sh.",
      "command": null
    },
    {
      "word": "Allowed",
      "prompt": "A commit adds a Dockerfile ADD of a remote URL pinned with --checksum.",
      "command": null
    }
  ]
}