AG-013
Shell or Command Execution
critical
Page text and source link for your AI assistant. Nothing is sent automatically.
What Foo Guard detects
One or more tools can execute shell or system commands.
When this rule triggers
a tool declares shell or command execution capability.
Foo Guard evaluates the normalized configuration supplied to the scanner. A finding describes configuration risk; it does not establish that an attack occurred. An absent finding does not prove that an undeclared capability is safe.
How to fix
Prefer a narrow tool with validated arguments over general command execution. Isolate unavoidable execution and restrict its identity, filesystem, and network access.
Verify the change
Update the actual agent configuration and the underlying permissions or controls, then run the scanner again. Inspect the finding’s evidence path to confirm the intended setting changed. Do not clear a finding by changing a declaration that no longer reflects the deployed agent.