open-coder-ai/block-secret-store-reads
v0.0.8Apache-2.0
Best-effort guard against an agent reading credentials from the shell: cat, cp, tar, source or < on ~/.ssh (not .pub), ~/.aws, ~/.npmrc, agent CLI dirs, browser DBs, wallets, .env, *.tfstate; interpreter one-liners naming them; token printers (gh auth token, aws sts); curl, wget or iwr to cloud metadata credential paths (169.254.169.254, 169.254.170.2, GCE). Asks on env dumps. Misses: scripts, unresolved variables, xargs lists, $(...) results, metadata reached by DNS name, proxy or SDK.
open-coder-ai publishes block-secret-store-reads in 3 places.
open-coder-ai/chock-claude-plugins
open-coder-ai/chock-copilot-plugins