Claude Skills by open-coder-ai

Pre-commit gate for the mechanizable slice of prompt-injection defense: invisible and direction-override Unicode in staged changes. Bidi controls make code read differently than it parses (Trojan Source, CVE-2021-42574); Unicode tag-block characters smuggle instructions that are invisible to a human reviewer but fully legible to the agent reading the file. Zero-width joiners and bidi marks (ZWJ/ZWNJ/LRM/RLM) are deliberately NOT matched -- they are legitimate in emoji sequences and in Persian...

Pre-commit gate for the mechanizable slice of excessive agency: committed agent permission grants that allow everything. A settings file whose shell grant or allow-list is a bare wildcard hands the agent unlimited tool authority for every future session, in a file reviewers rarely read as code. The agent-world twin of block-wildcard-iam: scope grants to what the task needs (e.g. Bash(git status:*)). Escape: 'pragma: allowlist broad-agency' on the same line.

Guard against an agent hand-editing its own guardrails. Agent instruction files (AGENTS.md and the per-agent wrappers), permission files (.claude/settings.json, .mcp.json) and vendored enforcement (.chock/bin/, .chock/compiled/) define what the agent may do -- so a shell command that rewrites them is the agent modifying its own authority (MITRE ATLAS AML.T0081; the AIVSS self-modification factor). The guard refuses shell write-commands targeting those paths; reads pass, and regeneration throu...

Keep the development conversation out of git history. Agent-authored commits narrate by default -- who asked for what, which discussion decided it, what the plan was -- and on a public repo that narration is published forever. The guard refuses git commit commands whose message (inline -m/--message or the file behind -F/--file) contains process-leak markers; the rule tells the agent to describe the change, not the conversation, and to propose sensitive messages to the human before committing....

Onboard a repo into Chock. args(repo_path, agents, agent_agnostic)

Run Chock policy eval suite. args(policy_path) returns(pass_rate,

Improve Chock policy from usage evidence. args(policy_path, >=3

Create conformant Chock policy from request. args(request, target_path,

Lint Chock policy conformance. args(policy_id or all) returns(findings,

Onboard a repo into Chock. args(repo_path, agents, agent_agnostic)

Run Chock policy eval suite. args(policy_path) returns(pass_rate,

Improve Chock policy from usage evidence. args(policy_path, >=3

Create conformant Chock policy from request. args(request, target_path,

Lint Chock policy conformance. args(policy_id or all) returns(findings,