Block Agents Started With Safety Off
Refuses a matched shell command before it runs.
Acts on
Shell command
When
Before the command runs
Tested
60 of 60 pass
In a git repo
In agent
What it does
Best effort. Refuses agents with safety off: claude --dangerously-skip-permissions, bypassPermissions, wildcard --allowedTools; codex --full-auto, --yolo, -a never, danger-full-access; gemini --yolo; cursor-agent --force; aider --yes-always; copilot --allow-all-tools; amp, cline, goose, opencode auto-approve; DeepSeek Harness 127.0.0.1:3080/api calls lifting sandbox/approvals (CVE-2026-82533). Sees through bash -c, sudo, npx. Misses: config, aliases, scripts, ssh, other dsh ports, file bodies.
Chock adds friction. It is not a security boundary.
Its label on each agent
The catalog grades each policy on each agent. Pick an agent to build with this policy:
- Claude Code TestedBlocks Refuses a matched shell command before it runsBuild →
- Cursor TestedBlocks Refuses a matched shell command before it runsBuild →
- Codex TestedBlocks Refuses a matched shell command before it runs. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- GitHub Copilot TestedBlocks Refuses a matched shell command before it runs. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- Devin TestedBlocks Refuses a matched shell command before it runs. If the hook errors, the action goes through (vendor docs only, not witnessed)Build →
- Grok Tested Not graded yet for GrokBuild →
- goose Tested Not graded yet for gooseBuild →
- Antigravity Tested Not graded yet for AntigravityBuild →
- OpenHands Untested Not graded yet for OpenHandsBuild →
- Kimi Code Untested Not graded yet for Kimi CodeBuild →
- Factory Droid Untested Not graded yet for Factory DroidBuild →
See it in action
Refused
A request launches Claude Code with permission prompts disabled.
claude --dangerously-skip-permissions -p "fix the tests"Allowed
A request runs Claude Code for a prompt with default approvals.
claude -p "review the diff"Both examples are this policy's own test cases.
What it misses
Config, aliases, scripts, ssh, other dsh ports, file bodies.
Latest change
0.2.3 · · Title wording only (IR-F40): "Block Unguarded Agent Spawn" is now "Block Agents Started With Safety Off". The id, guard and tests are unchanged.