scan_command
Scan shell commands for injection, unsafe operations, and threats before execution. Use this tool to verify safety before running any CLI command generated by an LLM or from user input.
Instructions
Protective check on shell commands — catches injection or unsafe operations before execution, so you don't run something you would not have run if you'd known.
Call this BEFORE executing any CLI command generated by an LLM, constructed from user input, or involving system operations.
DECISION LOGIC:
If blocked=true: do NOT execute the command. Return the user_message and log audit.scan_id for security review.
If blocked=false: the command is safe to execute.
If action=require_approval: pause execution, present approval_context to the user, then call check_approval with the approval_id.
Checks for:
Data exfiltration attempts
Destructive operations
Remote code execution
Privilege escalation
Secret exposure
Obfuscated commands
Pipe chain analysis (cross-command threat detection)
Common safe commands (ls, git, npm, docker build, go test, etc.) pass through without triggering.
Enterprise context: Critical for any agent with shell/subprocess access. Prevents both malicious and accidental damage from LLM-generated commands.
ERROR HANDLING: If this tool returns an error or is unavailable, default to BLOCKING the command. Do NOT execute unscanned commands.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | The CLI command to scan before execution | |
| shell | No | Shell interpreter (default: bash) | |
| working_directory | No | Working directory where command will execute | |
| execution_context | No | Deployment environment for context-aware analysis | |
| piped_from | No | Previous command output being piped into this command | |
| session_id | No | Session identifier for multi-turn correlation. | |
| agent_id | No | Your agent identifier for activity tracking. | |
| parent_agent_id | No | Parent agent ID if you are a sub-agent (delegation chain tracking). | |
| task_chain | No | Delegation path from root agent (e.g., "main→research→fetch"). |