# Policies Every catalog policy: what it does, its grade on each agent, what it misses, and an example. Each policy in the pinned catalog has its own page. A grade is the catalog's own label for that agent. > Ask the user before running any command on this page: each one changes how their agent or repository behaves. ## Policies | Policy | Label | Status | | --- | --- | --- | | [Agent Discipline](https://chock.sh/docs/policies/agent-discipline/index.md) | advisory | | | [Agentic Code Security](https://chock.sh/docs/policies/agentic-code-security/index.md) | blocks | | | [Block Agents Started With Safety Off](https://chock.sh/docs/policies/block-unguarded-agent-spawn/index.md) | blocks | | | [Block Curl Piped to Shell](https://chock.sh/docs/policies/block-curl-pipe-sh/index.md) | blocks | | | [Block Destructive Commands](https://chock.sh/docs/policies/block-destructive-commands/index.md) | blocks | | | [Block Files That Skip Git Hooks](https://chock.sh/docs/policies/block-hook-bypass-in-files/index.md) | blocks | | | [Block Invisible Unicode](https://chock.sh/docs/policies/block-invisible-unicode/index.md) | blocks | | | [Block Known-Malicious Packages](https://chock.sh/docs/policies/compromised-package-ioc/index.md) | blocks | | | [Block Persistence and Publishing Commands](https://chock.sh/docs/policies/block-persistence-shapes/index.md) | blocks | | | [Block Reading Stored Credentials](https://chock.sh/docs/policies/block-secret-store-reads/index.md) | blocks | | | [Block Risky Characters in File and Branch Names](https://chock.sh/docs/policies/refname-filename-metachar/index.md) | blocks | | | [Block Skipping Git Hooks](https://chock.sh/docs/policies/block-no-verify/index.md) | blocks | | | [Block Test Skips](https://chock.sh/docs/policies/block-test-skips/index.md) | blocks | | | [Block Unapproved Egress](https://chock.sh/docs/policies/block-unapproved-egress/index.md) | blocks | | | [Block Unpinned Agent Components](https://chock.sh/docs/policies/block-unpinned-agent-components/index.md) | blocks | | | [Block Unsafe Code Execution](https://chock.sh/docs/policies/block-unsafe-code-execution/index.md) | blocks | | | [Block Unsafe Package Registry Settings](https://chock.sh/docs/policies/registry-config/index.md) | blocks | | | [Block Weakened Build Hardening](https://chock.sh/docs/policies/hardening-flags/index.md) | blocks | | | [Block Wildcard Agent Permissions](https://chock.sh/docs/policies/block-wildcard-agent-permissions/index.md) | blocks | | | [Block Wildcard IAM Grants](https://chock.sh/docs/policies/block-wildcard-iam/index.md) | blocks | | | [CI GitHub Actions Security](https://chock.sh/docs/policies/ci-github-actions-security/index.md) | blocks | | | [Code Safety](https://chock.sh/docs/policies/code-safety/index.md) | advisory | | | [Context Hygiene](https://chock.sh/docs/policies/context-hygiene/index.md) | advisory | | | [Dependency Allowlist](https://chock.sh/docs/policies/verify-dependency-exists/index.md) | blocks | | | [Dockerfile and Compose Security](https://chock.sh/docs/policies/dockerfile-compose-security/index.md) | blocks | | | [EU AI Act — High-Risk Triage](https://chock.sh/docs/policies/eu-ai-act-high-risk-triage/index.md) | warns | | | [EU AI Act — Prohibited Practices](https://chock.sh/docs/policies/eu-ai-act-prohibited-practices/index.md) | advisory | | | [EU AI Act — Transparency](https://chock.sh/docs/policies/eu-ai-act-transparency/index.md) | advisory | | | [Flag Dev Tools That Run Code on Open](https://chock.sh/docs/policies/agent-devenv-autoexec/index.md) | warns | | | [Flag Downloads Run as Code in Files](https://chock.sh/docs/policies/block-fetch-exec-in-files/index.md) | warns | | | [Flag Hidden Binary Files in Tests](https://chock.sh/docs/policies/opaque-blob-guard/index.md) | warns | | | [Git Safety](https://chock.sh/docs/policies/git-safety/index.md) | advisory | | | [Guard Deletion and Mitigation Removal](https://chock.sh/docs/policies/guard-deletion/index.md) | blocks | | | [Guard Memory Writes](https://chock.sh/docs/policies/guard-memory-writes/index.md) | blocks | | | [IAM Policy Scan](https://chock.sh/docs/policies/iam-policy-scan/index.md) | blocks | | | [Injection Defense](https://chock.sh/docs/policies/injection-defense/index.md) | advisory | | | [Java Security Rules](https://chock.sh/docs/policies/java-security/index.md) | blocks | | | [Keep Accessibility From Regressing](https://chock.sh/docs/policies/no-a11y-regression/index.md) | blocks | | | [Keep Changes Small Enough to Review](https://chock.sh/docs/policies/limit-diff-size/index.md) | advisory | | | [Lockfile Integrity](https://chock.sh/docs/policies/lockfile-integrity/index.md) | blocks | | | [Match the Owner's Coding Style](https://chock.sh/docs/policies/chock-mise/index.md) | advisory | | | [Memory Discipline](https://chock.sh/docs/policies/memory-discipline/index.md) | advisory | | | [OWASP ASI01 — Agent Goal Hijack](https://chock.sh/docs/policies/owasp-asi01-agent-goal-hijack/index.md) | advisory | | | [OWASP ASI02 — Tool Misuse & Exploitation](https://chock.sh/docs/policies/owasp-asi02-tool-misuse/index.md) | advisory | | | [OWASP ASI03 — Identity & Privilege Abuse](https://chock.sh/docs/policies/owasp-asi03-identity-privilege-abuse/index.md) | advisory | | | [OWASP ASI04 — Agentic Supply Chain Vulnerabilities](https://chock.sh/docs/policies/owasp-asi04-agentic-supply-chain/index.md) | advisory | | | [OWASP ASI05 — Unexpected Code Execution](https://chock.sh/docs/policies/owasp-asi05-unexpected-code-execution/index.md) | advisory | | | [OWASP ASI06 — Memory & Context Poisoning](https://chock.sh/docs/policies/owasp-asi06-memory-context-poisoning/index.md) | advisory | | | [OWASP ASI07 — Insecure Inter-Agent Communication](https://chock.sh/docs/policies/owasp-asi07-insecure-inter-agent-communication/index.md) | advisory | | | [OWASP ASI08 — Cascading Failures](https://chock.sh/docs/policies/owasp-asi08-cascading-failures/index.md) | advisory | | | [OWASP ASI09 — Human-Agent Trust Exploitation](https://chock.sh/docs/policies/owasp-asi09-human-agent-trust/index.md) | advisory | | | [OWASP ASI10 — Rogue Agents](https://chock.sh/docs/policies/owasp-asi10-rogue-agents/index.md) | advisory | | | [Pin GitHub Actions](https://chock.sh/docs/policies/pin-github-actions/index.md) | blocks | | | [Protect Agent Config](https://chock.sh/docs/policies/protect-agent-config/index.md) | blocks | | | [Protect CI Workflows](https://chock.sh/docs/policies/protect-ci-workflows/index.md) | asks | | | [Protect Commit Privacy](https://chock.sh/docs/policies/protect-commit-privacy/index.md) | blocks | | | [Protect Main Branch](https://chock.sh/docs/policies/protect-main-branch/index.md) | advisory | | | [Protect Test Integrity](https://chock.sh/docs/policies/protect-test-integrity/index.md) | blocks | | | [Review Added Scanner Suppressions](https://chock.sh/docs/policies/scan-suppression-markers/index.md) | asks | | | [Review Cloud Identity Switches](https://chock.sh/docs/policies/ask-credential-switching/index.md) | blocks | | | [Review Like a Red Team](https://chock.sh/docs/policies/review-like-a-red-team/index.md) | advisory | | | [Review Scripts That Run on Install](https://chock.sh/docs/policies/package-lifecycle-scripts/index.md) | blocks | | | [Review Values That Look Like Secrets](https://chock.sh/docs/policies/scan-secrets-entropy/index.md) | asks | | | [Scan Agent Permission Settings](https://chock.sh/docs/policies/agent-permissions-scan/index.md) | blocks | | | [Scan Hidden Content](https://chock.sh/docs/policies/scan-hidden-content/index.md) | warns | | | [Scan Instruction Files](https://chock.sh/docs/policies/scan-instruction-files/index.md) | blocks | | | [Scan Secret Files](https://chock.sh/docs/policies/scan-secret-files/index.md) | blocks | | | [Scan Secrets](https://chock.sh/docs/policies/scan-secrets/index.md) | blocks | | | [Token Efficiency](https://chock.sh/docs/policies/token-efficiency/index.md) | advisory | | | [Use Firecrawl Only as a Fallback](https://chock.sh/docs/policies/firecrawl-fallback-only/index.md) | advisory | | | [Verify MCP Allowlist](https://chock.sh/docs/policies/verify-mcp-allowlist/index.md) | blocks | | --- Built from engine [5a4b6287a46e](https://github.com/open-coder-ai/chock/commit/5a4b6287a46e07f9f856d9bbe10622bd1ff2e021) and catalog [1e60d211c1bb](https://github.com/open-coder-ai/chock-catalog/commit/1e60d211c1bb767152c6ab0167932da06ab3a10f).