{
  "schema_version": 1,
  "id": "block-unguarded-agent-spawn",
  "track": "coding",
  "name": "Block Agents Started With Safety Off",
  "version": "0.2.3",
  "sha256": "9b94073bf7097e1599dd0feaa343855ebd0514a4d71e962ab6df8fe78bee996b",
  "sha256_v1": "191ecc1299d485dbcd4e5b84b2c7552a0836a95430e480cc1b218a11ac227e73",
  "keyword": "block",
  "word": "blocks",
  "says": "refuses a matched shell command before it runs",
  "description": "Best effort. Refuses agents with safety off: claude --dangerously-skip-permissions, bypassPermissions, wildcard --allowedTools; codex --full-auto, --yolo, -a never, danger-full-access; gemini --yolo; cursor-agent --force; aider --yes-always; copilot --allow-all-tools; amp, cline, goose, opencode auto-approve; DeepSeek Harness 127.0.0.1:3080/api calls lifting sandbox/approvals (CVE-2026-82533). Sees through bash -c, sudo, npx. Misses: config, aliases, scripts, ssh, other dsh ports, file bodies.",
  "misses": "config, aliases, scripts, ssh, other dsh ports, file bodies.",
  "where": [
    "command"
  ],
  "groups": [
    "agent-config"
  ],
  "eval_cases": 60,
  "eval_executed": 60,
  "latest": {
    "version": "0.2.3",
    "date": "2026-10-27",
    "change": "Title wording only (IR-F40): \"Block Unguarded Agent Spawn\" is now \"Block Agents Started With Safety Off\". The id, guard and tests are unchanged."
  },
  "agent_labels": {
    "claude-code": {
      "keyword": "block",
      "says": "refuses a matched shell command before it runs"
    },
    "cursor": {
      "keyword": "block",
      "says": "refuses a matched shell command before it runs"
    },
    "codex": {
      "keyword": "block",
      "says": "refuses a matched shell command before it runs. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)"
    },
    "copilot": {
      "keyword": "block",
      "says": "refuses a matched shell command before it runs. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)"
    },
    "devin": {
      "keyword": "block",
      "says": "refuses a matched shell command before it runs. If the hook errors, the action goes through (vendor docs only, not witnessed)"
    },
    "grok": {
      "keyword": "ungraded",
      "says": "Not graded yet for Grok"
    },
    "goose": {
      "keyword": "ungraded",
      "says": "Not graded yet for goose"
    },
    "antigravity": {
      "keyword": "ungraded",
      "says": "Not graded yet for Antigravity"
    },
    "openhands": {
      "keyword": "ungraded",
      "says": "Not graded yet for OpenHands"
    },
    "kimi-code": {
      "keyword": "ungraded",
      "says": "Not graded yet for Kimi Code"
    },
    "factory-droid": {
      "keyword": "ungraded",
      "says": "Not graded yet for Factory Droid"
    }
  },
  "source_url": "https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/block-unguarded-agent-spawn",
  "enforces": "best-effort (pre-tool-use, once hooks are installed; fails open if the hook crashes)",
  "examples": [
    {
      "word": "Refused",
      "prompt": "A request launches Claude Code with permission prompts disabled.",
      "command": "claude --dangerously-skip-permissions -p \"fix the tests\""
    },
    {
      "word": "Allowed",
      "prompt": "A request runs Claude Code for a prompt with default approvals.",
      "command": "claude -p \"review the diff\""
    }
  ]
}