---
title: "block-curl-pipe-sh"
description: "Best-effort guard against piping a network download straight into a shell or script interpreter: curl|wget|iwr ... | sh/bash/zsh/python/perl/ruby/node (bare or path-qualified, including subshell groups and sudo/exec/comm"
canonical: https://agentpluginsdirectory.com/plugins/block-curl-pipe-sh
last-updated: 2026-08-27
---

# block-curl-pipe-sh
Best-effort guard against piping a network download straight into a shell or script interpreter: curl|wget|iwr ... | sh/bash/zsh/python/perl/ruby/node (bare or path-qualified, including subshell groups and sudo/exec/command/env wrappers), bash -c "$(curl ...)", bash <(curl ...), and the PowerShell iwr ... | iex form. Downloading to a file, or piping a fetch into a non-interpreter tool (jq, tar, grep), stays allowed. Known bypass classes include aliases, variable indirection, base64/obfuscated payloads, env-var-prefixed interpreters, and non-standard fetch clients. This is friction, not a security boundary.
- Slug: block-curl-pipe-sh
- Publisher: chock-core
- Repository: https://github.com/open-coder-ai/chock-catalog
- Manifest: .agents/policies/block-curl-pipe-sh/plugin.json
- Version: 0.0.1
- License: Apache-2.0
- Category (editorial): security
- Skills: 1 (block-curl-pipe-sh)
- MCP servers: 0
- Stars: 1
- Listing: https://agentpluginsdirectory.com/plugins/block-curl-pipe-sh
- Schema: https://agent-plugins.org/schemas/1.0.0/plugin.schema.json