Chock.sh Build your plugin
Coding agents
Blocksv0.0.8 preset: Secrets

Block Reading Stored Credentials

Refuses a matched shell command before it runs.

Acts on

Shell command

When

Before the command runs

Tested

127 of 127 pass

In a git repo

In agent

What it does

Best-effort guard against an agent reading credentials from the shell: cat, cp, tar, source or < on ~/.ssh (not .pub), ~/.aws, ~/.npmrc, agent CLI dirs, browser DBs, wallets, .env, *.tfstate; interpreter one-liners naming them; token printers (gh auth token, aws sts); curl, wget or iwr to cloud metadata credential paths (169.254.169.254, 169.254.170.2, GCE). Asks on env dumps. Misses: scripts, unresolved variables, xargs lists, $(...) results, metadata reached by DNS name, proxy or SDK.

Chock adds friction. It is not a security boundary.

Its label on each agent

The catalog grades each policy on each agent. Pick an agent to build with this policy:

  • Claude Code TestedBlocks Refuses a matched shell command before it runsBuild →
  • Cursor TestedBlocks Refuses a matched shell command before it runs. Where its description says it asks, it asksBuild →
  • Codex TestedBlocks Refuses a matched shell command before it runs. Where its description says it asks, it refuses, because this client cannot prompt before a shell command. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
  • GitHub Copilot TestedBlocks Refuses a matched shell command before it runs. Where its description says it asks, it asks in VS Code and refuses in Copilot CLI, because it cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
  • Devin TestedBlocks Refuses a matched shell command before it runs. Where its description says it asks, it refuses, because this client cannot prompt before a shell command. If the hook errors, the action goes through (vendor docs only, not witnessed)Build →
  • Grok Tested Not graded yet for GrokBuild →
  • goose Tested Not graded yet for gooseBuild →
  • Antigravity Tested Not graded yet for AntigravityBuild →
  • OpenHands Untested Not graded yet for OpenHandsBuild →
  • Kimi Code Untested Not graded yet for Kimi CodeBuild →
  • Factory Droid Untested Not graded yet for Factory DroidBuild →

See it in action

Refused

A request asks the agent to print the npm auth file.

cat ~/.npmrc

Allowed

A request prints the example env template.

cat .env.example

Both examples are this policy's own test cases.

What it misses

Scripts, unresolved variables, xargs lists, $(...) results, metadata reached by DNS name, proxy or SDK.

Latest change

0.0.8 · · Title wording only (IR-F40): "Block Secret Store Reads" is now "Block Reading Stored Credentials". The id, guard and tests are unchanged.