open-coder-ai/block-secret-store-reads

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "block-secret-store-reads",
  "version": "0.0.8",
  "description": "Best-effort guard against an agent reading credentials from the shell: cat, cp, tar, source or < on ~/.ssh (not .pub), ~/.aws, ~/.npmrc, agent CLI dirs, browser DBs, wallets, .env, *.tfstate; interpreter one-liners naming them; token printers (gh auth token, aws sts); curl, wget or iwr to cloud metadata credential paths (169.254.169.254, 169.254.170.2, GCE). Asks on env dumps. Misses: scripts, unresolved variables, xargs lists, $(...) results, metadata reached by DNS name, proxy or SDK.",
  "author": {
    "name": "chock-core"
  },
  "repository": "https://github.com/open-coder-ai/chock-catalog",
  "license": "Apache-2.0",
  "keywords": [
    "chock",
    "policy-as-code",
    "rule",
    "advise",
    "asi03"
  ],
  "extensions": {
    "io.github.open-coder-ai": {
      "manifest": "manifest.yaml",
      "artifact": "rule",
      "enforcement": "advise",
      "coverage_without_chock": "advisory"
    }
  }
}