Every CLI You Run Has Your SSH Keys, Your `.env`, and Your Cloud Tokens. Here's a 100-Line Fence Around That.

In April 2026, a malicious version of the Bitwarden CLI was published to npm. It was live for about ninety minutes. In that window it read SSH keys, .env files, and AWS, Azure and GCP credentials off the machine of anyone who installed it. In October, the official OVHcloud CLI's repository was briefly compromised the same way — a bad build, caught and blocked in 94 minutes, but only after a customer noticed.

Neither of those is a virus you could have spotted. They are trusted tools with one bad update. Your antivirus asks "is this file known to be bad?" and waves through anything new.

And every CLI you run — a package manager, a release binary, a script a teammate sent you — runs as you, with full read access to your home folder: your ~/.ssh, your cloud credentials, your browser profile, your .env files.

Nothing stands between "I'll just try this tool" and "this tool just read every secret I own."

━━━━━━━━━━━━━━━━━━━━

𝗧𝗵𝗲 𝘂𝘀𝘂𝗮𝗹 𝗮𝗻𝘀𝘄𝗲𝗿𝘀 𝗮𝗿𝗲 𝘁𝗼𝗼 𝗵𝗲𝗮𝘃𝘆

Spin up a VM or a container just to try one throwaway tool, and you pay for it in minutes and gigabytes — and on Windows, the good isolation options want Pro, Hyper-V, or an admin you may not have.

So most of the time nobody isolates anything. The tool just runs.

━━━━━━━━━━━━━━━━━━━━

𝗔 𝗳𝗲𝗻𝗰𝗲 𝘆𝗼𝘂 𝗽𝘂𝘁 𝘂𝗽 𝗶𝗻 𝗼𝗻𝗲 𝗹𝗶𝗻𝗲

So I built ghl-jail: a small tool that runs one command so it can only touch the single project folder you point it at — and nothing else of yours.

No administrator rights, no install, no driver, no background service. Just Python and Windows (10 or 11, Home included).

python ghl_jail.py run --project C:\work\my-repo -- suspicious-tool.exe

Inside that folder, the tool works normally — it reads and writes with full freedom.

The moment it reaches for anything else — ~/.ssh, a cloud credential file, a token in your environment — it hits a wall:

Access is denied.

By default it also has no network, so there is nowhere to send what it cannot read anyway.

━━━━━━━━━━━━━━━━━━━━

𝗧𝗵𝗿𝗲𝗲 𝘄𝗮𝘆𝘀 𝗜 𝘂𝘀𝗲 𝗶𝘁

▪ Trying an untrusted or just-downloaded CLI without betting my SSH keys on it being honest.

▪ Keeping an autonomous coding agent inside the one repo it is working on — not my other projects, not my dotfiles, and offline unless I say otherwise. The blast radius of a bad command becomes one repo I can git reset.

▪ Running npm install / pip install so a malicious post-install script — the exact Bitwarden pattern — reaches the registry but never my credentials.

━━━━━━━━━━━━━━━━━━━━

𝗪𝗵𝗮𝘁 𝗶𝘁 𝗶𝘀 𝗻𝗼𝘁

It is harm reduction, not a vault.

It raises the cost of a mistake a great deal; it is not a guarantee against an attacker who is actively targeting this specific sandbox.

I would rather say that plainly than oversell a 100-line tool.

It is the fence you put around a tool before you decide to trust it — not a reason to run things you already know are malicious.

━━━━━━━━━━━━━━━━━━━━

Open source and free. Windows only.

https://gaphunterlabs.github.io/ghl-jail/ (Website)

https://github.com/GapHunterLabs/ghl-jail (Github)

— Joel Díaz, Founder, Gap Hunter Labs