Exec Security

Pre-flight security validation for shell commands. Catch dangerous patterns before they execute.

Quick Reference

Before running any non-trivial command, scan for these red flags:

1. 🔴 rm -rf, dd, mkfs → refuse
2. 🔴 echo $SECRET, printenv → use ${#VAR} instead
3. 🔴 Writes to /etc/, ~/.ssh/ → refuse unless user requested
4. 🟠 | curl, | nc, scp → ask user first
5. 🟠 curl | bash, wget | sh → ask user first
6. 🟠 IFS=, LD_PRELOAD= → ask user first
7. 🟡 eval, bash -c, $() with external data → warn
8. 🟡 Zero-width spaces, RTL override → warn
9. 🟡 =cmd (Zsh), zmodload, fork bombs → warn

Trigger Conditions