--- id: scan-instruction-files track: coding version: 0.0.1 label: blocks keyword: block where: write turn-end sha256: 50729a1023396ecf21e2931a9053b8fa677e78203215a817f3c611d5287aacc0 source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/scan-instruction-files catalog_ref: 1e60d211c1bb767152c6ab0167932da06ab3a10f --- # Scan Instruction Files scan-instruction-files · version 0.0.1 Blocks — Blocks on an agent's file writes and at turn end. Chock adds friction. It is not a security boundary. In a git repo: at commit (Chock refuses the commit, locally and in CI.) ## What it does Asks a person before a change adds injection text to an agent instruction file (AGENTS.md, CLAUDE.md, GEMINI.md, Cursor/Windsurf/Cline/Roo/Kiro rules, Copilot instructions and prompts, SKILL.md, agent commands): rule overrides, secrecy, auto-approve, hook or review bypass, fetch-and-run, remote instructions, role swaps, fake system tags, removed guardrails. Refuses secret exfiltration and encoded payloads. Added text only; English phrases; friction, not a boundary. ## Its label on each agent - Claude Code (tested): Blocks — Blocks on an agent's file writes and at turn end. Builder: /coding/builder/#client=claude-code&p=scan-instruction-files - Cursor (tested): Blocks — Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. Builder: /coding/builder/#client=cursor&p=scan-instruction-files - Codex (tested): Blocks — Blocks on an agent's file writes and at turn end. Where its description says it asks, it refuses at both points, because this client cannot prompt at either point. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=codex&p=scan-instruction-files - GitHub Copilot (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run). Builder: /coding/builder/#client=copilot&p=scan-instruction-files - Devin (tested): Blocks — Blocks at turn end only. It does not check a file write when it happens. Where its description says it asks, it refuses at turn end, because this client cannot prompt there. If the hook errors, the action goes through (vendor docs only, not witnessed). Builder: /coding/builder/#client=devin&p=scan-instruction-files - Grok (tested): Not graded yet for Grok. Builder: /coding/builder/#client=grok&p=scan-instruction-files - goose (tested): Not graded yet for goose. Builder: /coding/builder/#client=goose&p=scan-instruction-files - Antigravity (tested): Not graded yet for Antigravity. Builder: /coding/builder/#client=antigravity&p=scan-instruction-files - OpenHands (untested): Not graded yet for OpenHands. Builder: /coding/builder/#client=openhands&p=scan-instruction-files - Kimi Code (untested): Not graded yet for Kimi Code. Builder: /coding/builder/#client=kimi-code&p=scan-instruction-files - Factory Droid (untested): Not graded yet for Factory Droid. Builder: /coding/builder/#client=factory-droid&p=scan-instruction-files ## What it misses This policy does not state what it misses. ## Examples - Refused: A change to CLAUDE.md tells the agent to upload the developer's SSH private key to a remote host. - Allowed: AGENTS.md gains the ordinary rule never to commit secrets or .env files. ## Latest change 0.0.1 · 2026-10-02 — Initial draft (roadmap NP02). A script gate over agent instruction files, judged by path, case-insensitively: AGENTS.md (and AGENT.md, AGENTS.override.md), CLAUDE.md, CLAUDE.local.md, GEMINI.md, SKILL.md and MEMORY.md anywhere; .cursorrules, .windsurfrules, .clinerules (file or folder), .roorules; .cursor/rules/, .windsurf/rules/, .roo/rules*/, .kiro/steering/, .continue/{rules,prompts}/, .amazonq/rules/, .augment/rules/, .trae/rules/, .codex/prompts/, .gemini/commands/, .claude/{commands,agents,skills,memory}/; .github/copilot-instructions.md and .github/{instructions,prompts,agents,chatmodes}/; *.instructions.md, *.prompt.md, *.chatmode.md, *.agent.md; .junie/guidelines.md; memory/*.md; and \`.agents/policies/INDEX*.md\`, which chock's pointer in AGENTS.md tells every agent to read. Nothing is skipped by location: chock's installed copies (\`.agents/policies/\`, \`.chock/\`) and a catalog's policy skill pages are judged like any instruction file, because an agent loads them too. One exception is the engine's, not this script's: it never runs a policy's gate on that policy's own installed folder (\`.agents/policies/scan-instruction-files/\`), whose eval suite carries the text it refuses; protect-agent-config guards that folder's implementations/ only. Paths are folded (backslashes, \`//\`, \`.\`, \`..\`) before matching. ## Provenance - Tested by 31 of 32 cases run automatically - SHA-256: `50729a1023396ecf21e2931a9053b8fa677e78203215a817f3c611d5287aacc0` - Catalog commit: https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f - Source: https://github.com/open-coder-ai/chock-catalog/tree/1e60d211c1bb767152c6ab0167932da06ab3a10f/base/scan-instruction-files (catalog path `base/scan-instruction-files`) - Presets: Prompt injection and memory - JSON: `/api/coding/policies/scan-instruction-files.json` - Report a problem: https://chock.sh/report/?policy=scan-instruction-files&version=0.0.1&page=%2Fcoding%2Fpolicies%2Fscan-instruction-files%2F