---
id: block-secret-store-reads
track: coding
version: 0.0.8
label: blocks
keyword: block
where: command
sha256: 0f44fb772105be9088dda9cbbc602a56a7bc44c6c6cf6fed437efb209173dce0
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/block-secret-store-reads
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# Block Reading Stored Credentials

block-secret-store-reads · version 0.0.8

Blocks — Refuses a matched shell command before it runs. Chock adds friction. It is not a security boundary. 

In a git repo: in agent (The agent's hooks check this once chock sync sets them up. If the hook crashes, the action goes through.)



## What it does

Best-effort guard against an agent reading credentials from the shell: cat, cp, tar, source or \< on ~/.ssh (not .pub), ~/.aws, ~/.npmrc, agent CLI dirs, browser DBs, wallets, .env, *.tfstate; interpreter one-liners naming them; token printers (gh auth token, aws sts); curl, wget or iwr to cloud metadata credential paths (169.254.169.254, 169.254.170.2, GCE). Asks on env dumps. Misses: scripts, unresolved variables, xargs lists, $(...) results, metadata reached by DNS name, proxy or SDK.

## Its label on each agent

- Claude Code (tested): Blocks — Refuses a matched shell command before it runs. Builder: /coding/builder/#client=claude-code&p=block-secret-store-reads
- Cursor (tested): Blocks — Refuses a matched shell command before it runs. Where its description says it asks, it asks. Builder: /coding/builder/#client=cursor&p=block-secret-store-reads
- Codex (tested): Blocks — Refuses a matched shell command before it runs. Where its description says it asks, it refuses, because this client cannot prompt before a shell command. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=block-secret-store-reads
- GitHub Copilot (tested): Blocks — Refuses a matched shell command before it runs. Where its description says it asks, it asks in VS Code and refuses in Copilot CLI, because it cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=block-secret-store-reads
- Devin (tested): Blocks — Refuses a matched shell command before it runs. Where its description says it asks, it refuses, because this client cannot prompt before a shell command. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=block-secret-store-reads
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=block-secret-store-reads
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=block-secret-store-reads
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=block-secret-store-reads
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=block-secret-store-reads
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=block-secret-store-reads
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=block-secret-store-reads

## What it misses

Scripts, unresolved variables, xargs lists, $(...) results, metadata reached by DNS name, proxy or SDK.

## Examples

- Refused: A request asks the agent to print the npm auth file. — `cat ~/.npmrc`
- Allowed: A request prints the example env template. — `cat .env.example`

## Latest change

0.0.8 · 2026-10-27 — Title wording only (IR-F40): "Block Secret Store Reads" is now "Block Reading Stored Credentials". The id, guard and tests are unchanged.

## Provenance

- Tested by 127 of 127 cases run automatically
- SHA-256: `0f44fb772105be9088dda9cbbc602a56a7bc44c6c6cf6fed437efb209173dce0`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/block-secret-store-reads (catalog path `base/block-secret-store-reads`)
- Presets: Secrets
- JSON: `/api/coding/policies/block-secret-store-reads.json`
- Report a problem: https://chock.sh/report/?policy=block-secret-store-reads&version=0.0.8&page=%2Fcoding%2Fpolicies%2Fblock-secret-store-reads%2F