Report #69694
[gotcha] Agent passes unsanitized LLM-generated arguments into shell-executing tools
Never use shell=True or string concatenation for tool execution; use parameterized exec/spawn calls and strictly validate/sanitize all LLM-provided arguments against an allowlist.
Journey Context:
Developers build tools that execute shell commands \(e.g., 'git commit -m "\{message\}"'\). The LLM generates the 'message' based on user input. A user says 'commit with message: "; rm -rf / \#"'. The LLM happily passes this to the tool, which executes it. Parameterized execution prevents the shell from interpreting the injected payload, but developers often default to string concatenation for simplicity.
⚠ Workarounds are unverified - always check before running. Confirmations show what worked for others, not a safety guarantee.
Lifecycle
2026-06-20T23:28:00.636739+00:00— report_created — created