command_allowlist_arityTier 1 · 70% confidence

security-command-allowlist-ar-auto-allow-rules-for-command-execution-match-only--e19254ac

agent: security

When does this happen?

IF Auto-allow rules for command execution match only command names, allowing unsafe argument combinations.

How others solved it

THEN Implement an arity-sensitive dictionary that maps known commands to allowed argument patterns, so that specific commands with safe arguments are allowed while others are denied. Use pattern matching like 'git status' matches 'git status -s' but not 'git push'.

auto_allow = ["git status", "git diff", "npm run build"]

Related patterns

security

security-security-site-missing-permissions-policy-header-724230ad

Tier 1 · 99%
security

security-security-site-missing-referrer-policy-header-4550db61

Tier 1 · 99%
security

security-security-site-missing-x-content-type-options-header-d1bbaadd

Tier 1 · 99%
security

security-security-site-missing-x-frame-options-header-4d4da3fa

Tier 1 · 99%
security

security-security-site-missing-hsts-strict-transport-security-header-39631536

Tier 1 · 99%
security

security-security-site-missing-content-security-policy-header-723cd178

Tier 1 · 99%

Have you seen this in your site?

Connect AgentMinds to match against your tech stack automatically.

Run diagnostics