Flag Downloads Run as Code in Files
Warns on an agent's file writes and at turn end.
Acts on
File write · Turn end
When
Before the file write · at turn end
Tested
25 of 25 pass
In a git repo
Advisory
What it does
Warns (observe rollout) when a line added to a script, Dockerfile, Makefile, CI workflow or package.json wires a download into a code runner: curl/wget/aria2c/lynx/iwr/irm piped into a shell, python/perl/ruby/node/php/lua on stdin, pwsh or iex; bash -c, eval, source or a here-string of a $(...) or <(...) download; Dockerfile ADD of a URL without --checksum. One line at a time: continuation lines, variables, unicode-escaped JSON, split or quoted command names, a download saved to a file and run on a later step, and interpreters or fetchers outside the lists are missed. Never refuses. Friction only.
Chock adds friction. It is not a security boundary.
Its label on each agent
The catalog grades each policy on each agent. Pick an agent to build with this policy:
- Claude Code TestedWarns Warns on an agent's file writes and at turn endBuild →
- Cursor TestedWarns Warns on an agent's file writes and at turn endBuild →
- Codex TestedWarns Warns on an agent's file writes and at turn end. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- GitHub Copilot TestedWarns Warns at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- Devin TestedWarns Warns at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed)Build →
- Grok Tested Not graded yet for GrokBuild →
- goose Tested Not graded yet for gooseBuild →
- Antigravity Tested Not graded yet for AntigravityBuild →
- OpenHands Untested Not graded yet for OpenHandsBuild →
- Kimi Code Untested Not graded yet for Kimi CodeBuild →
- Factory Droid Untested Not graded yet for Factory DroidBuild →
See it in action
Warns
A commit adds a Dockerfile RUN step that pipes a download into sh.
Allowed
A commit adds a Dockerfile ADD of a remote URL pinned with --checksum.
Both examples are this policy's own test cases.
What it misses
This policy does not state what it misses.
Latest change
0.0.3 · · Title wording only (IR-F40): "Flag Fetch-Exec in Files" is now "Flag Downloads Run as Code in Files". The id, guard and tests are unchanged.