Security context

Highlights

Command Injection: 2 prior fixes. Scrutinize any change in this area.

src/cai/agents/guardrails.py: most-fixed (2 issues). Treat as high-risk during review.

5 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

Command Injection: The sshpass tool naively constructed shell commands using string replacement for parameters like host, username, password, and commands. This allowed remote attackers or manipulated AI agents to execute arbitrary system commands via shell injection. The fix introduced robust parameter sanitization using shlex.quote.

Command Injection: Prompt injection attempts could bypass human-in-the-loop validation and execute dangerous utility configurations (like socat or obfuscated system commands). Mitigation required implementing strict regex pattern matching and input-filtering guardrails within the core agent execution path.

Remote Code Execution: The filesystem discovery tool permitted dangerous command-line argument flags during execution, exposing a direct pathway to remote code execution. The vulnerability was resolved by instituting a strict blocklist of prohibited CLI arguments.