block-unapproved-egress

Links

• github.com/open-coder-ai/chock-catalog
• .agents/policies/block-unapproved-egress/plugin.json (manifest)

Skills · 1

block-unapproved-egress

Best-effort guard against exfiltration through the tool channel: a network command (curl/wget/Invoke-WebRequest) that UPLOADS data, POST/PUT, --data/--form, --upload-file, --post-file, to a host outside the egress allowlist. The allowlist defaults to package registries and code hosting and is m…

Descriptions come from the frontmatter of each SKILL.md, punctuation lightly normalized.

Category

Security & Compliance. Assigned by this directory. Agent Plugins 1.0.0 has no category field, so no manifest declares one.

Keywords

chock · policy-as-code · rule · advise · asi02

Related by publisher and keywords

• block-destructive-commandsopen-coder-ai

  Best-effort guard against destructive commands, read as parsed commands (bash -c and cd chains included, echo excluded): rm -rf on absolute, home ($HOME/~) or root-adjacent paths (and PowerShell Remove-Item -Recurse); git push --force (not --force-with-lease), reset --hard, clean -f; kubectl delete; terraform destroy; aws s3 rm --recursive / rb --force; dropdb; helm uninstall/delete; docker volume rm/prune and system prune; gcloud... delete; find -delete / -exec rm; shred; truncate; wipefs -a. git branch -D asks first. Verbs are matched position-aware, so a bucket or object NAMED like a verb is allowed, and a relative path in the working tree stays allowed. sudo, doas and pkexec are transparent. A pre-push hook refuses any non-fast-forward push, force, +refspec or lease alike; a human escapes with git push --no-verify. Known bypasses: aliases, an unusual value-flag, interpreters and scripts. Friction, not a security boundary.

• block-curl-pipe-shopen-coder-ai

  Best-effort guard against piping a download into a shell or interpreter: curl, wget, lynx, aria2c, iwr/irm and similar fetchers piped into sh/bash/zsh/dash/ksh/fish/python/perl/ruby/node, bare, path-qualified or quoted, in a subshell group or behind sudo/exec/env/xargs/nohup/timeout; also bash -c "$(curl...)", bash <(curl...) and PowerShell `| iex`. Saving to a file, or piping into jq/tar/grep, is allowed. Bypasses: aliases, variables, obfuscation. Friction only.

• block-destructive-commandsopen-coder-ai

  Best-effort, on parsed commands (echo ignored). Blocks rm -rf on absolute, ~, $HOME,. or.. paths; recursive Remove-Item/rd/del on drive paths; git push --force or +refspec, reset --hard, clean -f, checkout.; kubectl delete; terraform destroy; aws s3 rm --recursive/rb --force; dropdb; helm uninstall; docker volume rm/prune, system prune; find -delete/-exec rm; shred; truncate; wipefs -a/-o; gcloud with any `delete` operand. branch -D asks. Pre-push hook refuses non-fast-forward pushes.

• owasp-asi02-tool-misuseopen-coder-ai

  Constrain what an agent's legitimate tools can be made to do. Grant least agency per task, validate tool parameters at the runtime boundary, authorise every invocation rather than only the first, and distrust tool metadata from unverified registries. Use when defining tool schemas, wiring an MCP server, granting shell or cloud-CLI access, or reviewing a tool-calling loop. Do NOT use for the credentials the tool authenticates with, that is `owasp-asi03-identity-privilege-abuse`.

• protect-ci-workflowsopen-coder-ai

  Stops an agent weakening the checks that review its work. Shell guard refuses writes to.github/workflows/,.github/actions/ and.github/dependabot.yml|yaml: redirect, rm/mv/tee/sed -i, cp into, git checkout/restore, Set-Content/Add-Content/Out-File. Reads and `chock sync` pass. Best-effort, coarse. No marker bypass: a person edits from their own shell. Shell only: Edit/Write to these paths is not checked (no gate). Backstop: server-side branch protection.

• rtk-dangerous-actions-blockeropen-coder-ai

  Deprecated: use block-destructive-commands, which shares this policy's destructive-command table. rtk#1007. Same table as block-destructive-commands: blocks root/home/.git deletes, force/delete/mirror pushes, reset --hard, clean -f, switch --discard, IaC destroy, cloud deletes, DB drops, lockouts; asks rm -rf off rtk's safe list, one named kubectl delete, bare lease, stash drop, prunes; dry-run flags pass. Own rows block credential-file reads (.env, keys, ~/.ssh) and echo or inline *_API_KEY/_SECRET/_TOKEN. Skips file rows in container exec.