Your agent tried to ship your AWS keys

Mid-diff with YOLO on, your coding agent tried to post a local cloud-keys file off-box with curl. That is long-lived credential material, not a log snippet. If the transfer completes, the keys left the machine.

HOL Guard maps that shape to the built-in command.data-protection Extension. Catalog: Command data protection. Built-in, v1.0.0. Two high-severity operations. Catalog default for both: review.

Exact credential-file curl strings live on that directory page. The blog write path still blocks pasting some of them here, so this post uses a safe dummy path for the live demo and points at the catalog for the verbatim lines.

What the approval screen looks like

When policy keeps the floor at review, Guard pauses before exec. On the local approval center the decision buttons are Allow just this once (green) and Keep blocked. Extension evidence is not an allow by itself. Until you choose Allow just this once, the curl has not left the machine.

Source of truth for this post is the Core local dashboard at http://127.0.0.1:5201 (nav: Home / Inbox / Protect / Evidence; Manage: Extensions, Rules & exceptions, Supply chain, Settings). A PreToolUse hook from Claude Code created the pending review below. Inbox shows PAUSED ACTION / Needs review. We did not screenshot Desktop AppImage for the approval card on this box.

If you Keep blocked, the action stays stopped. Receipt stays local.

Where you operate this

Guard Core stays headless and owns policy, approvals, receipts, the daemon, and the local dashboard. Guard Desktop is the optional tray/control center (macOS 13+ Apple silicon, Windows x64 MSI, Linux x86_64 AppImage). Closing the tray does not turn enforcement off.

Surfaces that matter for this Extension:

• PreToolUse pause: agent hits the hook; Rust parses the line once; you get Allow just this once or Keep blocked in Inbox.
• Protect / Extensions in the local dashboard (Modules; /extensions remains a compatibility route). Posture: Protected, Extra careful, or Watch. Default Protected. Watch records without stopping.
• Approval center on loopback at http://127.0.0.1:5201, or hol-guard approvals from a terminal.

What Guard maps

The directory names two operations:

• Credential data transfer (command.data-protection.permission.credential-exfiltration). Catalog example: curl that posts the cloud credentials file off-box. Default floor: review.
• Local file upload (command.data-protection.permission.file-upload). Catalog example: curl that uploads a local report PDF. Default floor: review.

Those lines come from the catalog. A workspace can tighten to block or weaken the floor unless a managed-restrictive Control Set pins the Extension. Catalog default is not your fleet policy.

Live proof on this box used a dummy path under /tmp (not a real home-directory credentials file) so the blog paste stays clear of the write-path filter. hol-guard command test on that line returned REVIEW. Extension command.data-protection, controlling rule command.data-protection.file-upload, risks credential_exfiltration and network_egress. The same shape under a PreToolUse hook landed in Inbox as Needs review. Screenshots above show the paused queue item.

Out of scope

command.data-protection does not cover:

• Reading a secret file locally with cat or an editor. Mapped ops are send and upload.
• Browser MCP tools posting a form.
• Package installs (npx, pip): Package Firewall Extensions.
• Decoded pipe-to-shell shapes: command.encoded-execution.
• An agent calling hol-guard approvals approve on itself: command.guard-self-protection.

A directory listing is not a security certification or an upstream endorsement.

One check that does not run curl

command test and command explain do not execute the command, create an approval, or write a receipt.

hol-guard command test '<paste dummy demo path from post notes, or catalog credential-exfiltration example>'
hol-guard command explain '<paste catalog file-upload example>'
hol-guard command controls show command.data-protection
hol-guard command extensions

Demo shape used on this box: a curl that posts /tmp/demo-cloud-keys to example.com (safe dummy; not a home credentials path). Copy catalog examples from the directory page for the literal credential-file lines. After an upgrade, run the test before you trust muscle memory. If test says unrecognized, confirm the Extension is current and posture is not Watch.

Limits

Built-in command Extension, catalog default review, two high-severity send/upload shapes, on harnesses Guard already intercepts. Not a CVE writeup. Not model antivirus. Will not pause every outbound curl.

Keep a living 3.0.x tip. Background: HOL Guard 3.0.

Operating it

Built-in coverage ships in the native runtime. Change the permission in Protect / Extensions or via CLI. For a team floor local YOLO cannot weaken, use a managed-restrictive Control Set on this Extension's permission IDs.

If you meant the upload, choose Allow just this once with your eyes on the URL. If you did not, Keep blocked and find which prompt or MCP tool suggested the curl. Receipt stays local. Cloud sync is optional and does not carry the raw command.