assess_shell_command
Analyze shell commands for hidden malicious constructs that bypass pattern-based security guards by detecting shell expansions like command substitution, variable injection, and obfuscation.
Instructions
Assess a shell command for constructs that look benign to naive string matching but execute something else once a shell actually expands them.
Closes the bypass class GuardFall (2026-06) confirmed against 10 of 11 popular open-source AI coding agents (Aider, Cline, Goose, Plandex, and others): their command-safety guards check the raw string a model wrote, not what the shell rewrites it into via quote removal, backslash escapes, command substitution, and variable/IFS expansion. Never executes the command or any part of it.
Tokenizes with real POSIX quote-removal rules so quote-fragmented or
backslash-obfuscated commands (r'm' -rf /) normalize to what actually
runs (rm -rf /) before any check. Flags command substitution
($(...), backticks, recursively assessed), unquoted variable
expansion, IFS manipulation, ANSI-C quoting, a fetch or encoded-payload
decode piped straight into an interpreter (curl ... | sh,
base64 -d | sh), setuid grants (chmod +s, install -m 4755),
and in-place credential-file overwrites (sed -i/tee targeting
~/.aws/credentials and similar). Also flags the shell-level shape of
Cursor's DuneSlide disclosure (CVE-2026-50548/50549): a symlink whose
target or link name lands on a sensitive path (ln -s ~/.ssh/id_rsa ./notes.txt), and a cd into a sensitive directory chained with a
further command that would act on relative paths inside it (cd ~/.aws && cat credentials). Also flags Cursor's Terminal Tool Allowlist
Bypass (CVE-2026-22708): export/typeset/declare/readonly/
local assigning a behavior-redirecting variable (PAGER,
BROWSER, PYTHONWARNINGS, PERL5OPT) that a later, separately-
approved command would then respect, plus zsh's zero-click ${(e):-...}
forced-parameter-expansion construct. Returns risk (safe,
suspicious, or dangerous), per-segment findings, and
bypassed_raw_pattern_match -- concrete evidence a normalized segment
caught something the raw text alone would have missed.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes |
Output Schema
| Name | Required | Description | Default |
|---|---|---|---|
No arguments | |||