block-unapproved-egress

{
  "$schema": "https://agent-plugins.org/schemas/1.0.0/plugin.schema.json",
  "name": "block-unapproved-egress",
  "version": "0.1.0",
  "description": "Best-effort guard against exfiltration through the tool channel: a network command (curl/wget/Invoke-WebRequest) that UPLOADS data -- POST/PUT, --data/--form, --upload-file, --post-file -- to a host outside the egress allowlist. The allowlist defaults to package registries and code hosting and is meant to be extended with your org's own domains; a host matches by exact name or \".<entry>\" suffix. Fetch-only traffic is left alone. A schemeless or protocol-relative target is checked too, from the last non-flag token, but only when no explicit http(s):// URL appears -- once one has, it alone decides. Options are parsed as curl reads them, so -sd @file is an upload. Tool-time FLOOR, not a network sandbox. Known bypasses: ~/.curlrc, obfuscated payloads, non-standard clients, a language runtime. Escape: 'pragma: allowlist egress'.",
  "author": {
    "name": "chock-core"
  },
  "repository": "https://github.com/open-coder-ai/chock",
  "license": "Apache-2.0",
  "keywords": [
    "chock",
    "policy-as-code",
    "rule",
    "advise",
    "{'control': 'asi02', 'coverage': 'partial', 'note': 'raises the floor against tool-channel data exfiltration to unapproved hosts; a tool-time guard, not a network sandbox -- obfuscated, non-standard-client and runtime egress remain out of reach'}"
  ],
  "extensions": {
    "io.github.open-coder-ai": {
      "manifest": "manifest.yaml",
      "artifact": "rule",
      "enforcement": "advise",
      "coverage_without_chock": "advisory"
    }
  }
}