AGGIB

Stroq — AI skill for Claude Code

AI community

Local action firewall for AI coding agents: scans what the agent reads, taints the session, blocks dangerous follow-up actions.

How to install Stroq

This entry records only its repository, not the path inside it, so there is no exact command to give. Open AGGIB/Stroq and copy the folder into ~/.claude/skills/, or the file into ~/.claude/agents/.

What Stroq does

Local action firewall for AI coding agents: scans what the agent reads, taints the session, blocks dangerous follow-up actions.

Alternatives in AI

TokenTracker — Local-first AI token usage & cost tracker for 31 coding tools incl 1.4k ★
Tokentab — A CLI that reads Claude Code, Codex, and Gemini CLI session logs and works out how much they cost, by model, p 226 ★
Linggen Memory — Local-first semantic memory for AI assistants — one store your preferences, decisions and gotchas follow you i 108 ★

README

Local action firewall for AI coding agents

Scans what the agent reads. Taints the session. Blocks the dangerous follow-up — before anything leaves your machine.

[![CI](https://github.com/AGGIB/Stroq/actions/workflows/ci.yml/badge.svg)](https://github.com/AGGIB/Stroq/actions/workflows/ci.yml) [![stroq attack: 12/12 stopped](https://img.shields.io/badge/stroq%20attack-12%2F12%20stopped-1f9d55)](#replay-twelve-real-incidents) [![npm version](https://img.shields.io/npm/v/%40stroq%2Fcli?logo=npm&logoColor=white&label=npm&color=cb3837)](https://www.npmjs.com/package/@stroq/cli) [![npm downloads](https://img.shields.io/npm/d18m/%40stroq%2Fcli?label=downloads&color=0b7285)](https://www.npmjs.com/package/@stroq/cli) [![License: Apache 2.0](https://img.shields.io/badge/license-Apache%202.0-blue.svg)](LICENSE) [![Node >= 22](https://img.shields.io/badge/node-%3E%3D22-339933?logo=node.js&logoColor=white)](package.json)

npx @stroq/cli init

Supported today: **Claude Code**, **Cursor**, **Codex**, **Copilot CLI**, **Windsurf** (native hooks) · **OpenClaw** (in-process plugin) · **any MCP client** (stdio proxy)

**Website:** [stroq.vercel.app](https://stroq.vercel.app)

Why

Coding agents read untrusted content constantly — web pages, file contents, MCP tool results, the output of commands they just ran themselves. When that content hides instructions, an agent that dutifully follows what it reads can turn them into real actions: outbound network requests, secret reads, external git pushes, arbitrary shell execution.

Stroq sits on the agent's own tool-call hooks and enforces a deterministic, local policy on those actions. No cloud round trip, no proxy, and no relying on the model to notice the injection itself.