Static source inference · medium confidence · detected: Logging
Deprecated protocol patterns detected
Summary
Single tool 'execute_command' has a proper schema and description, but lacks critical safety guardrails. The tool is destructive (can execute arbitrary commands locally and remotely) yet has no confirmation/dry-run mechanism, no parameter validation constraints, no error guidance for recovery, and no permission gating. Description is adequate (162 chars) but omits critical prerequisites and limitations. Schema is complete with all parameters typed, but lacks enums and constraints on dangerous inputs. The 'command' parameter accepts free-form strings with no injection protection documented or visible in the code. Overall, this meets minimum definition standards but fails several critical safety patterns for destructive operations.
Tools (1)
execute_commanddestructiveauthsource verified
Execute commands on remote hosts or locally (This tool can be used for both remote hosts and the current machine)
No confirmation/dry-run for destructive operations. execute_command can delete files, kill processes, or wipe systems with no agent awareness of irreversibility. Pattern requires confirmation mechanism for destructive tools.
Command parameter accepts free-form strings with no injection validation or sanitization visible in code. LLMs can be tricked into passing shell metacharacters, command substitution, or path traversal payloads. No validation logic shown in executor.ts beyond type coercion.
Missing error classification and recovery guidance. Code catches SSH errors but returns generic messages. No guidance for retryable vs fatal errors, no actionable recovery steps for agents (e.g., 'SSH failed: check credentials', 'timeout: retry with longer deadline').
Add a 'dry_run' boolean parameter (default false) to preview command without execution. Document: 'When true, returns what would execute without side effects.'
Add input validation in executor.ts: reject commands containing shell metacharacters (|, ;, &, $, backticks) unless explicitly allowed. Return actionable error: 'Command contains shell operators. Use escaped strings or separate tool calls.'
Enhance error messages with recovery guidance: 'SSH connection failed: Check SSH key at ~/.ssh/id_rsa and verify host in ~/.ssh/config. Retry with correct username.' Include which step failed (key loading, auth, shell creation).
Add permission checks: validate that the calling agent has 'exec:*' or 'exec:local'/'exec:remote' scope before executing. Log: 'User agent called execute_command on [host] at [timestamp] with command: [safe redacted command]. Result: [status]'.
Revise description to: 'Execute shell commands on local or remote Unix/Linux systems via SSH. IRREVERSIBLE, commands cannot be undone. Supports session reuse for stateful operations (conda, virtual envs) for 20 minutes. Requires: SSH key-based auth to remote hosts (~/.ssh/id_rsa), target host reachable on port 22. Returns raw stdout/stderr up to 10MB. For destructive commands (rm, drop database, kill process), confirm intent before executing.'
Document output schema in description: 'Returns {stdout: string, stderr: string}. stdout contains normal command output; stderr contains error messages and warnings. Both are raw unprocessed text. Output truncated if > 10MB.'
Score history
Overall score trend
↓ 33 points across a rubric change (v1 → v2)
10/100
Scored
Grade
Overall
Spec posture
Rubric
2026-09-22
F
10
<=2025-11-25
v2
2026-03-09
F
43
-
v1
No permission gating. execute_command has no auth checks, any agent calling it can run arbitrary commands. No scope declaration (e.g., 'requires admin:exec'), no RBAC layer, no audit trail of who invoked what command.
Description omits critical prerequisites and limitations. Does not state: 'This tool is destructive, commands cannot be undone', 'SSH key-based auth required on target', 'Session reuse may cause state conflicts', 'No shell escaping applied, LLM must ensure safe payloads'. LLMs cannot infer these constraints.
Output schema not documented. The tool returns stdout/stderr as plain text. No documentation of: expected format, maximum output length, whether binary output is supported, how to parse multiline responses. LLMs must guess structure.
env parameter lacks constraint documentation. No description of: which env vars are allowed (could leak secrets?), format validation, size limits. LLMs may pass arbitrary values including credentials.
host and username parameters could accept opaque IDs or hostnames interchangeably with no guidance. Description says 'optional' for host but required for username, yet the code checks both together. Dependency not clearly documented.
execute_command
Add env parameter validation: 'Environment variables to inject into command. Keys and values must be alphanumeric + underscore. Do not pass secrets or API keys, use host-side .env files. Example: {"NODE_ENV": "production"}.'
Add explicit constraint to host/username parameters: 'If host is specified, username is REQUIRED. Both are case-sensitive. For local execution, omit both parameters. Example: host="prod-server.example.com", username="deploy".'
Add session documentation: 'Session name for terminal state reuse. Same session maintains shell history and environment for 20 minutes. Use separate sessions for parallel independent tasks. Default: "default". Example: "conda-ml" for ML environment setup.'
Implement timeout mechanism with user-facing guidance: If command hangs >30s, return 'Command timeout after 30 seconds. This may indicate a process waiting for input or a system hang. Retry with a simpler command or add --timeout flag if supported.'
Add batch variant: offer 'execute_commands' taking an array of {command, timeout} objects to reduce multi-step overhead, or document that agents should call execute_command in sequence.