---
id: block-unguarded-agent-spawn
track: coding
version: 0.2.3
label: blocks
keyword: block
where: command
sha256: 9b94073bf7097e1599dd0feaa343855ebd0514a4d71e962ab6df8fe78bee996b
source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/block-unguarded-agent-spawn
catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f
---

# Block Agents Started With Safety Off

block-unguarded-agent-spawn · version 0.2.3

Blocks — Refuses a matched shell command before it runs. Chock adds friction. It is not a security boundary. 

In a git repo: in agent (The agent's hooks check this once chock sync sets them up. If the hook crashes, the action goes through.)



## What it does

Best effort. Refuses agents with safety off: claude --dangerously-skip-permissions, bypassPermissions, wildcard --allowedTools; codex --full-auto, --yolo, -a never, danger-full-access; gemini --yolo; cursor-agent --force; aider --yes-always; copilot --allow-all-tools; amp, cline, goose, opencode auto-approve; DeepSeek Harness 127.0.0.1:3080/api calls lifting sandbox/approvals (CVE-2026-82533). Sees through bash -c, sudo, npx. Misses: config, aliases, scripts, ssh, other dsh ports, file bodies.

## Its label on each agent

- Claude Code (tested): Blocks — Refuses a matched shell command before it runs. Builder: /coding/builder/#client=claude-code&p=block-unguarded-agent-spawn
- Cursor (tested): Blocks — Refuses a matched shell command before it runs. Builder: /coding/builder/#client=cursor&p=block-unguarded-agent-spawn
- Codex (tested): Blocks — Refuses a matched shell command before it runs. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=block-unguarded-agent-spawn
- GitHub Copilot (tested): Blocks — Refuses a matched shell command before it runs. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=block-unguarded-agent-spawn
- Devin (tested): Blocks — Refuses a matched shell command before it runs. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=block-unguarded-agent-spawn
- Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=block-unguarded-agent-spawn
- goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=block-unguarded-agent-spawn
- Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=block-unguarded-agent-spawn
- OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=block-unguarded-agent-spawn
- Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=block-unguarded-agent-spawn
- Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=block-unguarded-agent-spawn

## What it misses

Config, aliases, scripts, ssh, other dsh ports, file bodies.

## Examples

- Refused: A request launches Claude Code with permission prompts disabled. — `claude --dangerously-skip-permissions -p "fix the tests"`
- Allowed: A request runs Claude Code for a prompt with default approvals. — `claude -p "review the diff"`

## Latest change

0.2.3 · 2026-10-27 — Title wording only (IR-F40): "Block Unguarded Agent Spawn" is now "Block Agents Started With Safety Off". The id, guard and tests are unchanged.

## Provenance

- Tested by 60 of 60 cases run automatically
- SHA-256: `9b94073bf7097e1599dd0feaa343855ebd0514a4d71e962ab6df8fe78bee996b`
- Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f
- Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/block-unguarded-agent-spawn (catalog path `base/block-unguarded-agent-spawn`)
- Presets: Agent configuration
- JSON: `/api/coding/policies/block-unguarded-agent-spawn.json`
- Report a problem: https://chock.sh/report/?policy=block-unguarded-agent-spawn&version=0.2.3&page=%2Fcoding%2Fpolicies%2Fblock-unguarded-agent-spawn%2F