AG-001: Unrestricted Shell/Code Execution

What this rule means

A tool in this agent can execute arbitrary shell commands or code (via subprocess.run, os.system, eval, exec, etc.) and is not sandboxed. The tool's body was inspected — this is not just a name match.

Why it matters

If an attacker can inject instructions into the agent (via a poisoned document, email, or tool return), they can run any command as the agent's OS user. This is full system compromise, not a data leak. Real precedent: CVE-2025-54795 (Claude Code argument injection).

How to fix it

• Sandbox: wrap the tool in a container with no network and limited filesystem.
• Allowlist: restrict the command to a known-safe set (no wildcards).
• Human approval: require explicit confirmation before execution.

→ LangGraph: interrupt_before on the exec node

→ General: add a confirmation callback

Detect it

pip install lucin
lucin scan .                  # all rules
lucin explain AG-001          # this rule, in your terminal

Findings carry a file:line and, where the rule supports it, a witness path showing the flow that triggered it. Precision and recall for the whole rule set, with the commands that regenerate them, are on the benchmarks page — and the gaps are on limits.

← All detection rules