feat(security): add detection rules for destructive shell commands#1484
feat(security): add detection rules for destructive shell commands#1484pzlav wants to merge 6 commits intoagentscope-ai:mainfrom
Conversation
github-actions
bot
added
the
first-time-contributor
Summary of ChangesHello, I'm Gemini Code Assist1! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed! This pull request significantly enhances the security posture by expanding the Highlights
🧠 New Feature in Public Preview: You can now enable Memory to help Gemini Code Assist learn from your team's feedback. This makes future code reviews more consistent and personalized to your project's style. Click here to enable Memory in your admin console. Changelog
Activity
Using Gemini Code AssistThe full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips. Invoking Gemini You can request assistance from Gemini at any point by creating a comment using either
Customization To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a Limitations & Feedback Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for GitHub and other Google products, sign up here. You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension. Footnotes
|
There was a problem hiding this comment.
Pull request overview
This PR expands the tool-guard’s built-in YAML ruleset for execute_shell_command to detect and gate a wider set of destructive, privilege-escalating, obfuscated, and suspicious shell command patterns, reducing the chance an agent executes high-risk commands without user intervention.
Changes:
- Added new detection rules for filesystem/device destruction, destructive Git operations, fork bombs/DoS, pipe-to-shell downloaders, reverse shells, system tampering, unsafe permissions, and base64-obfuscated execution.
- Assigned severities/categories and provided user-facing remediation guidance per rule.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
src/copaw/security/tool_guard/rules/dangerous_shell_commands.yaml
Outdated
Show resolved
Hide resolved
src/copaw/security/tool_guard/rules/dangerous_shell_commands.yaml
Outdated
Show resolved
Hide resolved
| category: privilege_escalation | ||
| severity: HIGH | ||
| patterns: | ||
| - "\\bchmod\\s+-[a-zA-Z]*R[a-zA-Z]*\\s+(777|a\\+rwx)\\s+\\/" |
| category: command_injection | ||
| severity: HIGH | ||
| patterns: | ||
| - "\\bgit\\s+reset\\s+(--hard|-h\\b)" |
| severity: HIGH | ||
| patterns: | ||
| - "\\bgit\\s+reset\\s+(--hard|-h\\b)" | ||
| - "\\bgit\\s+checkout\\s+(--\\s+\\.|\\.)" |
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces a valuable set of new detection rules for various dangerous shell commands, significantly enhancing the security posture of the tool guard. The rules are well-structured and cover a wide range of threats, from filesystem destruction to command obfuscation. I've provided a few suggestions to refine some of the regular expressions for improved accuracy and broader coverage. Overall, this is a strong security enhancement.
| category: privilege_escalation | ||
| severity: HIGH | ||
| patterns: | ||
| - "\\bchmod\\s+-[a-zA-Z]*R[a-zA-Z]*\\s+(777|a\\+rwx)\\s+\\/" |
There was a problem hiding this comment.
The current chmod pattern is very specific, only detecting recursive changes to the root directory (/). This misses many other dangerous scenarios, such as chmod 777 /etc/shadow or chmod -R 777 . in a sensitive directory. A more general pattern would provide much broader protection against unsafe permission changes.
- "\\bchmod\\s+.*(777|a\\+rwx)"| category: command_injection | ||
| severity: HIGH | ||
| patterns: | ||
| - "\\bgit\\s+reset\\s+(--hard|-h\\b)" |
There was a problem hiding this comment.
The pattern for git reset incorrectly includes -h as a destructive option. The -h flag is an alias for --help and is not a destructive operation. git does not have a short option for --hard. Removing |-h\b will make the rule more accurate and prevent potential false positives on users trying to get help for the command.
- "\\bgit\\s+reset\\s+--hard"| severity: HIGH | ||
| patterns: | ||
| - "\\bcrontab\\b" | ||
| - "authorized_keys" |
There was a problem hiding this comment.
The pattern authorized_keys is a bit too broad and could lead to false positives by matching substrings within other words (e.g., a script named update_authorized_keys_format.sh). Using word boundaries (\b) will ensure that it only matches the whole word authorized_keys, improving the rule's precision.
- "\\bauthorized_keys\\b"| category: code_execution | ||
| severity: HIGH | ||
| patterns: | ||
| - "\\bbase64\\s+(-d|--decode)\\s*\\|\\s*(bash|sh|zsh)" |
There was a problem hiding this comment.
This pattern for obfuscated execution is good, but it could be more comprehensive. The TOOL_CMD_PIPE_TO_SHELL rule includes ash and dash in its list of shells. To maintain consistency and broaden detection capabilities, it would be beneficial to add them to this rule as well.
- "\\bbase64\\s+(-d|--decode)\\s*\\|\\s*(bash|sh|zsh|ash|dash)"Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds additional rule-based tool-guard detections to block or prompt on a broader set of destructive / high-risk shell command patterns.
Changes:
- Extend
dangerous_shell_commands.yamlwith new detection rules for filesystem destruction, destructive Git operations, fork bombs/DoS, pipe-to-shell loaders, reverse shells, system tampering, unsafe permissions, and base64-obfuscated execution. - Assign severity/category metadata and remediation guidance per rule.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - "\\bgit\\s+reset\\s+(--hard|-h\\b)" | ||
| - "\\bgit\\s+checkout\\s+(--\\s+\\.|\\.)" | ||
| - "\\bgit\\s+clean\\s+-[a-zA-Z]*f" | ||
| - "\\bgit\\s+push\\s+.*(--force|-f\\b)" |
| category: code_execution | ||
| severity: CRITICAL | ||
| patterns: | ||
| - "(curl|wget)\\s+.*\\|\\s*(bash|sh|zsh|ash|dash)" |
pzlav
temporarily deployed
to
maintainer-approved
GitHub Actions
Inactive
|
Please check whether Copilot’s recommendations are worth considering. Thanks for your contribution :) |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
Adds additional tool-guard YAML rules to detect and block/prompt on a wider set of destructive or high-risk shell commands executed via execute_shell_command, expanding beyond existing rm/mv guards.
Changes:
- Added new detection rules for filesystem/block-device destruction, destructive Git operations, DoS/fork bombs, pipe-to-shell downloaders, reverse shells, system tampering, unsafe permissions, and base64-obfuscated execution.
- Included severity levels and remediation guidance per rule.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| patterns: | ||
| - "\\bmkfs\\b" | ||
| - "\\bdd\\s+.*of=\\/dev\\/" | ||
| - ">\\s*\\/dev\\/(sda|nvme|vd)" |
src/copaw/security/tool_guard/rules/dangerous_shell_commands.yaml
Outdated
Show resolved
Hide resolved
| category: privilege_escalation | ||
| severity: HIGH | ||
| patterns: | ||
| - "\\bchmod\\s+-[a-zA-Z]*R[a-zA-Z]*\\s+(777|a\\+rwx)\\s+\\/" |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR expands CoPaw’s tool-guard rule set for execute_shell_command by adding YAML-based detection rules for a wider range of destructive or high-risk shell behaviors, aiming to prompt/block unsafe commands before execution.
Changes:
- Added new detection rules for filesystem/device destruction, destructive Git operations, fork bombs, pipe-to-shell downloaders, reverse shells, system tampering, unsafe permissions, and obfuscated execution.
- Assigned severities/categories and provided remediation guidance for each new rule.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
src/copaw/security/tool_guard/rules/dangerous_shell_commands.yaml
Outdated
Show resolved
Hide resolved
| patterns: | ||
| - "\\bmkfs\\b" | ||
| - "\\bdd\\s+.*of=\\/dev\\/" | ||
| - ">\\s*\\/dev\\/(sda|nvme|vd)" |
| category: command_injection | ||
| severity: HIGH | ||
| patterns: | ||
| - "\\bgit\\s+reset\\s+(--hard|--merge|--keep)" |
| patterns: | ||
| - "\\bgit\\s+reset\\s+(--hard|--merge|--keep)" | ||
| - "\\bgit\\s+checkout\\s+(--\\s+\\.|\\.)" | ||
| - "\\bgit\\s+clean\\s+-[a-zA-Z]*f" |
| - "\\bnc\\s+.*-e\\s+" | ||
| - "\\bncat\\s+.*-e\\s+" |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
There was a problem hiding this comment.
Pull request overview
This PR extends CoPaw’s tool-guard rule set to detect and intercept a broader range of destructive or high-risk shell commands (beyond existing rm/mv detection), aiming to prompt/block agent execution before damage occurs.
Changes:
- Added new YAML rules covering filesystem/block device destruction, destructive Git operations, fork bombs / DoS, pipe-to-shell download execution, reverse shells, system tampering, unsafe permissions, and base64-obfuscated execution.
- Annotated each rule with severity, category, patterns, and remediation guidance.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| - "\\bmkfs(\\.[a-zA-Z0-9_]+)?\\b" | ||
| - "\\bmke2fs\\b" | ||
| - "\\bdd\\s+.*of=\\/dev\\/" | ||
| - ">\\s*\\/dev\\/(sda|nvme|vd)" |
| patterns: | ||
| - "\\bgit\\s+reset\\s+(--hard|--merge|--keep)" | ||
| - "\\bgit\\s+checkout\\s+(--\\s+\\.|\\.)" | ||
| - "\\bgit\\s+clean\\s+-[a-zA-Z]*f" |
| - "\\bgit\\s+push\\s+.*(--force|-f\\b)" | ||
| - "\\bgit\\s+stash\\s+(drop|clear)" | ||
| description: "Detects destructive Git operations that discard uncommitted work or rewrite remote history" | ||
| remediation: "Suggest using 'git stash' instead of reset/checkout, or 'git push --force-with-lease'." |
| - "\\bnc\\s+.*-e\\s+" | ||
| - "\\bncat\\s+.*-e\\s+" |
| severity: HIGH | ||
| patterns: | ||
| - "\\bcrontab\\b" | ||
| - "authorized_keys" |
|
Thanks for the PR. ── Git Data Loss ─────────────────────────────────────────────────────
We find that this rule is not necessary. Please delete this rule and revise the rules to make them more precise. |
Description
Add YAML detection rules for dangerous shell commands beyond the existing
rmandmvguards. New rules cover filesystem destruction (mkfs, dd), destructive Git operations (reset --hard, push --force), fork bombs, curl|bash pipes, reverse shells, crontab/sudoers tampering, unsafe permissions (chmod 777), and base64-obfuscated execution. Each rule includes severity, pattern matching, and remediation guidance so the user is always prompted or blocked before execution.Related Issue: Fixes #(issue_number) or Relates to #(issue_number)
Security Considerations: These rules are defensive — they add tool_guard rules to prevent agents from executing destructive, privilege-escalating, or obfuscated shell commands without user confirmation. No existing rules are removed or weakened.
Type of Change
Component(s) Affected
Checklist
pre-commit run --all-fileslocally and it passespytestor as relevant) and they passTesting
mkfs /dev/sda,git reset --hard,curl ... | bash) and do not false-positive on safe usage (e.g.git push origin mainwithout--force).TOOL_CMD_DANGEROUS_RMandTOOL_CMD_DANGEROUS_MVrules still work as before.Local Verification Evidence
pytest
====================================== test session starts ======================================
platform linux -- Python 3.10.12, pytest-9.0.2, pluggy-1.6.0
rootdir: /home/pzla/projects/CoPaw
configfile: pyproject.toml
plugins: anyio-4.12.1, asyncio-1.3.0, cov-7.0.0
asyncio: mode=auto, debug=False, asyncio_default_fixture_loop_scope=function, asyncio_default_test_loop_scope=function
collected 64 items
tests/integrated/test_app_startup.py . [ 1%]
tests/integrated/test_version.py ... [ 6%]
tests/test_cli_version.py . [ 7%]
tests/unit/providers/test_anthropic_provider.py ....... [ 18%]
tests/unit/providers/test_default_provider.py .. [ 21%]
tests/unit/providers/test_minimax_provider.py ....... [ 32%]
tests/unit/providers/test_ollama_manager_timeout.py . [ 34%]
tests/unit/providers/test_ollama_provider.py .............. [ 56%]
tests/unit/providers/test_openai_provider.py ........... [ 73%]
tests/unit/providers/test_openai_stream_toolcall_compat.py .. [ 76%]
tests/unit/providers/test_provider_manager.py ............... [100%]
====================================== 64 passed in 9.17s =======================================