Unverified50% confidenceDecision RuleExact time
The validator outright rejects | sh, | bash, xargs, eval, and redirections like > / and >>, excluding executing pipes entirely from the first commands in runbooks.
1
Sources
50%
Confidence
Long-term
Relevance
10/18/2026
First Seen
Sources
Related Entities
Related Claims
UnverifiedThe validator allows specific binaries and subcommands, outright rejects write operation verbs, rejects pipes to a shell, and fails closed on anything it does not recognize.74% similarUnverifiedBash permission rules with the intermediate pattern :* were previously skipped in settings files; the new version makes them take effect from all sources and issues a warning about the matching method at startup.68% similarUnverifiedBefore the fix, recursive deletion commands like rm -rf "$(pwd)" whose targets came solely from command substitution output would execute silently without prompting in auto mode and --dangerously-skip-permissions mode; after the fix, the user will be actively asked even if a Bash allow rule exists, unless CLAUDE_CODE_DISABLE_SUBSTITUTION_RM_PROMPT=1 is set.68% similarUnverifiedIn a command ending in kubectl get ... | sh, what actually executes is the shell on the right side of the pipe, whose contents are entirely unconstrained by the allowlist.65% similarUnverifiedBefore constructing the prompt, regular expressions should be used to remove instruction-shaped lines (such as `ignore previous instructions`, `disregard ... instructions`, `you are now`), and the prompt should state that the logs are data rather than instructions.64% similar
Cite This Claim
Stable URI
https://kongchang.com/claim/1059216API
curl https://kongchang.com/api/v1/knowledge/claims/1059216MCP
get_claim(id=1059216)