block-wildcard-agent-permissions

Links

• github.com/open-coder-ai/chock
• .agents/policies/block-wildcard-agent-permissions/plugin.json (manifest)

Skills · 1

• block-wildcard-agent-permissions

Category

Security & Compliance — assigned by this directory, not declared in the manifest.

Keywords

chock · policy-as-code · hook · block · {'control': 'asi03' · 'coverage': 'partial' · 'note': 'blocks the everything-grant a diff can show (llm03 excessive agency); least-agency tool design remains advisory (owasp-asi02-tool-misuse · owasp-asi03-identity-privilege-abuse)'}

Related plugins

• block-wildcard-iamopen-coder-ai

  Pre-commit gate for the mechanizable slice of ASI03: wildcard Action or Resource in IAM policy documents, AdministratorAccess attachment, GCP roles/owner or roles/editor, and Terraform wildcard action/resource lists. An agent's identity design stays with the advisory owasp-asi03 policy; this blocks the grants whose blast radius is everything. Escape: 'pragma: allowlist broad-privilege' on the same line.

• block-invisible-unicodeopen-coder-ai

  Pre-commit gate for the mechanizable slice of prompt-injection defense: invisible and direction-override Unicode in staged changes. Bidi controls make code read differently than it parses (Trojan Source, CVE-2021-42574); Unicode tag-block characters smuggle instructions that are invisible to a human reviewer but fully legible to the agent reading the file. Zero-width joiners and bidi marks (ZWJ/ZWNJ/LRM/RLM) are deliberately NOT matched -- they are legitimate in emoji sequences and in Persian, Arabic and Indic text -- so ordinary internationalised content passes; only the override/embed/isolate controls and the tag block, which have no honest use in a source tree, are blocked. Escape: 'pragma: allowlist invisible-unicode' on the same line.

• block-unpinned-agent-componentsopen-coder-ai

  Pre-commit gate for the mechanizable slice of ASI04: agent components pulled at an unpinned version. Blocks npx/uvx/bunx launches at @latest — the standard MCP server idiom — quoted "@latest" arguments in agent config, and :latest container images. Language-manifest dependencies are verify-dependency-exists; signature and provenance stay with the advisory owasp-asi04 policy. Escape: 'pragma: allowlist unpinned' on the same line.

• block-unsafe-code-executionopen-coder-ai

  Pre-commit gate for the mechanizable slice of ASI05: bare eval/exec, shell-mode subprocess calls, os.system, pickle/marshal loads, yaml.load without SafeLoader, execSync, new Function. Best-effort line scan; sandbox design, egress, and inherited credentials stay with the advisory owasp-asi05 policy. Escape hatch for vetted uses: 'pragma: allowlist exec' on the same line.

• protect-agent-configopen-coder-ai

  Guard against an agent hand-editing its own guardrails. Agent instruction files (AGENTS.md and the per-agent wrappers), permission files (.claude/settings.json, .mcp.json) and vendored enforcement (.chock/bin/, .chock/compiled/) define what the agent may do -- so a shell command that rewrites them is the agent modifying its own authority (MITRE ATLAS AML.T0081; the AIVSS self-modification factor). The guard refuses shell write-commands targeting those paths; reads pass, and regeneration through `chock sync` passes because the tool writes them itself rather than through shell editing. Best-effort and deliberately coarse: a compound command that both reads a protected file and writes elsewhere may be refused -- rewrite it in two steps. Escape for a human-approved change: include 'chock: approved-config-change' in the command.

• protect-main-branchopen-coder-ai

  Block direct commits and pushes to main or master. Enforced at commit time by reading the current branch, and at push time by parsing the refs the agent is pushing.

Show the badge

block-wildcard-agent-permissions passed verification against the official 1.0.0 schema. Add the badge to your README to show it — it links readers to this verified listing.

[![Verified Agent Plugin](https://agentpluginsdirectory.com/badge.svg)](https://agentpluginsdirectory.com/plugins/block-wildcard-agent-permissions)