---
id: block-fetch-exec-in-files
track: coding
version: 0.0.3
label: warns
keyword: warn
where: write turn-end
sha256: 5bbae80a44b9d27a8ba1911c68af93caf09f718065dc83197b3adb99be9a514b
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/block-fetch-exec-in-files
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# Flag Downloads Run as Code in Files

block-fetch-exec-in-files · version 0.0.3

Warns — Warns on an agent's file writes and at turn end. Chock adds friction. It is not a security boundary. 

In a git repo: advisory (The agent reads the text, and nothing stops a violation.)



## What it does

Warns (observe rollout) when a line added to a script, Dockerfile, Makefile, CI workflow or package.json wires a download into a code runner: curl/wget/aria2c/lynx/iwr/irm piped into a shell, python/perl/ruby/node/php/lua on stdin, pwsh or iex; bash -c, eval, source or a here-string of a $(...) or \<(...) download; Dockerfile ADD of a URL without --checksum. One line at a time: continuation lines, variables, unicode-escaped JSON, split or quoted command names, a download saved to a file and run on a later step, and interpreters or fetchers outside the lists are missed. Never refuses. Friction only.

## Its label on each agent

- Claude Code (tested): Warns — Warns on an agent's file writes and at turn end. Builder: /coding/builder/#client=claude-code&p=block-fetch-exec-in-files
- Cursor (tested): Warns — Warns on an agent's file writes and at turn end. Builder: /coding/builder/#client=cursor&p=block-fetch-exec-in-files
- Codex (tested): Warns — Warns on an agent's file writes and at turn end. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=block-fetch-exec-in-files
- GitHub Copilot (tested): Warns — Warns at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=block-fetch-exec-in-files
- Devin (tested): Warns — Warns at turn end only. It does not check a file write when it happens. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=block-fetch-exec-in-files
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=block-fetch-exec-in-files
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=block-fetch-exec-in-files
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=block-fetch-exec-in-files
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=block-fetch-exec-in-files
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=block-fetch-exec-in-files
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=block-fetch-exec-in-files

## What it misses

This policy does not state what it misses.

## Examples

- Warns: A commit adds a Dockerfile RUN step that pipes a download into sh.
- Allowed: A commit adds a Dockerfile ADD of a remote URL pinned with --checksum.

## Latest change

0.0.3 · 2026-10-27 — Title wording only (IR-F40): "Flag Fetch-Exec in Files" is now "Flag Downloads Run as Code in Files". The id, guard and tests are unchanged.

## Provenance

- Tested by 25 of 25 cases run automatically
- SHA-256: `5bbae80a44b9d27a8ba1911c68af93caf09f718065dc83197b3adb99be9a514b`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/block-fetch-exec-in-files (catalog path `base/block-fetch-exec-in-files`)
- Presets: Shell containment
- JSON: `/api/coding/policies/block-fetch-exec-in-files.json`
- Report a problem: https://chock.sh/report/?policy=block-fetch-exec-in-files&version=0.0.3&page=%2Fcoding%2Fpolicies%2Fblock-fetch-exec-in-files%2F