Policies
Block Agents Started With Safety Off
Block Agents Started With Safety Off: what it does, its label on each agent, what it misses, and examples.
Catalog policy block-unguarded-agent-spawn, version 0.2.3, labelled blocks on Claude Code.
What it does
Best effort. Refuses agents with safety off: claude --dangerously-skip-permissions, bypassPermissions, wildcard --allowedTools; codex --full-auto, --yolo, -a never, danger-full-access; gemini --yolo; cursor-agent --force; aider --yes-always; copilot --allow-all-tools; amp, cline, goose, opencode auto-approve; DeepSeek Harness 127.0.0.1:3080/api calls lifting sandbox/approvals (CVE-2026-82533). Sees through bash -c, sudo, npx. Misses: config, aliases, scripts, ssh, other dsh ports, file bodies.
On each agent
| Agent | Label | What it does there |
|---|---|---|
| Claude Code | Blocks | Refuses a matched shell command before it runs |
| Cursor | Blocks | Refuses a matched shell command before it runs |
| Codex | Blocks | Refuses a matched shell command before it runs. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run) |
| GitHub Copilot | Blocks | Refuses a matched shell command before it runs. If the hook errors, the action goes through (not witnessed; the vendor's row is only partly live-run) |
| Devin | Blocks | Refuses a matched shell command before it runs. If the hook errors, the action goes through (vendor docs only, not witnessed) |
| Grok | Not graded | Not graded yet for Grok |
| goose | Not graded | Not graded yet for goose |
| Antigravity | Not graded | Not graded yet for Antigravity |
| OpenHands | Not graded | Not graded yet for OpenHands |
| Kimi Code | Not graded | Not graded yet for Kimi Code |
| Factory Droid | Not graded | Not graded yet for Factory Droid |
What it misses
Config, aliases, scripts, ssh, other dsh ports, file bodies.
Examples from its eval suite
Refused: A request launches Claude Code with permission prompts disabled.
claude --dangerously-skip-permissions -p "fix the tests"Allowed: A request runs Claude Code for a prompt with default approvals.
claude -p "review the diff"More
Built from engine 5a4b6287a46e and catalog 1e60d211c1bb.