Scan Instruction Files
Blocks on an agent's file writes and at turn end.
Acts on
File write · Turn end
When
Before the file write · at turn end
Tested
31 of 32 pass
In a git repo
At commit
What it does
Asks a person before a change adds injection text to an agent instruction file (AGENTS.md, CLAUDE.md, GEMINI.md, Cursor/Windsurf/Cline/Roo/Kiro rules, Copilot instructions and prompts, SKILL.md, agent commands): rule overrides, secrecy, auto-approve, hook or review bypass, fetch-and-run, remote instructions, role swaps, fake system tags, removed guardrails. Refuses secret exfiltration and encoded payloads. Added text only; English phrases; friction, not a boundary.
Chock adds friction. It is not a security boundary.
Its label on each agent
The catalog grades each policy on each agent. Pick an agent to build with this policy:
- Claude Code TestedBlocks Blocks on an agent's file writes and at turn endBuild →
- Cursor TestedBlocks Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either pointBuild →
- Codex TestedBlocks Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- GitHub Copilot TestedBlocks Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run)Build →
- Devin TestedBlocks Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (vendor docs only, not witnessed)Build →
- Grok Tested Not graded yet for GrokBuild →
- goose Tested Not graded yet for gooseBuild →
- Antigravity Tested Not graded yet for AntigravityBuild →
- OpenHands Untested Not graded yet for OpenHandsBuild →
- Kimi Code Untested Not graded yet for Kimi CodeBuild →
- Factory Droid Untested Not graded yet for Factory DroidBuild →
See it in action
Refused
A change to CLAUDE.md tells the agent to upload the developer's SSH private key to a remote host.
Allowed
AGENTS.md gains the ordinary rule never to commit secrets or .env files.
Both examples are this policy's own test cases.
What it misses
This policy does not state what it misses.
Latest change
0.0.1 · · Initial draft (roadmap NP02). A script gate over agent instruction files, judged by path, case-insensitively: AGENTS.md (and AGENT.md, AGENTS.override.md), CLAUDE.md, CLAUDE.local.md, GEMINI.md, SKILL.md and MEMORY.md anywhere; .cursorrules, .windsurfrules, .clinerules (file or folder), .roorules; .cursor/rules/, .windsurf/rules/, .roo/rules*/, .kiro/steering/, .continue/{rules,prompts}/, .amazonq/rules/, .augment/rules/, .trae/rules/, .codex/prompts/, .gemini/commands/, .claude/{commands,agents,skills,memory}/; .github/copilot-instructions.md and .github/{instructions,prompts,agents,chatmodes}/; *.instructions.md, *.prompt.md, *.chatmode.md, *.agent.md; .junie/guidelines.md; memory/*.md; and .agents/policies/INDEX*.md, which chock's pointer in AGENTS.md tells every agent to read. Nothing is skipped by location: chock's installed copies (.agents/policies/, .chock/) and a catalog's policy skill pages are judged like any instruction file, because an agent loads them too. One exception is the engine's, not this script's: it never runs a policy's gate on that policy's own installed folder (.agents/policies/scan-instruction-files/), whose eval suite carries the text it refuses; protect-agent-config guards that folder's implementations/ only. Paths are folded (backslashes, //, ., ..) before matching.