Your agent tried to ship your AWS keys

Originally published at HOL

You left Claude Code running. Mid-session it tried to send your AWS keys to a website you never opened. Whoever gets those keys can spin up servers on your bill. That is the laptop you code on.

HOL Guard caught the send and froze it before it left the machine. Two buttons on screen: Allow just this once, or Keep blocked. Do not tap Allow and the keys stay on the laptop. The assistant does not click for you.

Local Inbox review for a paused Claude Code command. Queue shows the curl; the card is PAUSED ACTION / Needs review with Allow just this once and Keep blocked.

Button labels on the live review card: Allow just this once, Keep blocked. Scope defaults to a one-time allow for this exact action.

Keep blocked leaves the action stopped. The receipt stays on your machine.

What Guard is watching for

This shape maps to the built-in Command data protection Extension (command.data-protection, v1.0.0). Catalog default for both operations is review:

• Credential data transfer (command.data-protection.permission.credential-exfiltration). Curl that posts a cloud credentials file off the machine.
• Local file upload (command.data-protection.permission.file-upload). Curl that uploads a local report PDF.

Exact credential-file curl strings live on that directory page. This post uses a /tmp dummy for the live demo so the write path stays clear of filters that trip on home credential paths.

A workspace can tighten to block or loosen the floor unless a managed-restrictive Control Set pins the Extension. Catalog default is not your fleet policy.

Live proof used a dummy under /tmp. hol-guard command test on that line returned REVIEW under command.data-protection.file-upload, with risks credential_exfiltration and network_egress. The same shape under a PreToolUse hook landed in Inbox as Needs review.

Settings → Protection: Protected (default), Extra careful, Watch.

Extensions / Modules in the local dashboard. command.data-protection ships built-in.

How the pause shows up

Guard Core owns policy, approvals, receipts, the daemon, and the local dashboard. Guard Desktop is the optional tray UI. Closing the tray does not turn enforcement off. Install from hol.org/guard/install if you want the tray; local by default, Cloud sync optional.

Install Guard Desktop from hol.org/guard/install when you want the tray UI.

Agent tool use hits a PreToolUse hook; Guard parses the line once; Inbox offers Allow just this once or Keep blocked. Protect / Extensions sets posture: Protected (default), Extra careful, or Watch. Watch records without stopping. Approvals also work from hol-guard approvals in a terminal you control.

Out of scope

command.data-protection does not cover:

• Reading a secret file locally with cat or an editor. Mapped ops are send and upload.
• Browser MCP tools posting a form.
• Package installs (npx, pip): Package Firewall Extensions.
• Decode-and-execute shell chains: command.encoded-execution.
• An agent calling hol-guard approvals approve on itself: command.guard-self-protection.

One check that does not run curl

command test and command explain do not execute the command, create an approval, or write a receipt.

hol-guard command test '<WAF-safe dummy: curl posts /tmp/demo-cloud-keys to example.com>'
hol-guard command explain '<catalog file-upload example from directory page>'
hol-guard command controls show command.data-protection
hol-guard command extensions

Rehearse with a /tmp dummy path (not a home credentials path). The live proof shape returned REVIEW under command.data-protection.file-upload. Copy catalog examples from the directory page for the literal credential-file strings. After an upgrade, run the test before you trust muscle memory. If test says unrecognized, confirm the Extension is current and posture is not Watch.

What this does not claim

This is a pause on two send and upload shapes Guard already intercepts. It will not stop every outbound curl. Reading a secret file in an editor is not this Extension.

Change the permission in Protect / Extensions or via CLI. For a team floor local auto-approve settings cannot weaken, use a managed-restrictive Control Set on this Extension's permission IDs.

If you meant the upload, choose Allow just this once with your eyes on the URL. If you did not, Keep blocked and find which prompt or MCP tool suggested the curl. Receipt stays local. Cloud sync is optional and does not carry the raw command.

Background: HOL Guard 3.0.