shellfence: detect dangerous shell commands an agent ran in AI agents

Offline dangerous-shell-command auditor for commands an AI agent actually ran (or attempted) via Bash / shell / terminal tools.

What it detects

Offline dangerous-shell-command auditor for commands an AI agent actually ran (or attempted) via Bash / shell / terminal tools.

When an agent can Bash, run_command, shell, or PowerShell, a prompt injection or confused tool choice can steer it into curl | bash, rm -rf /, reverse shells, chmod 777, force-pushes, publishes, firewall flushes, env exfil, or crontab persistence. shellfence extracts those commands from saved transcripts (or a plain command list), classifies each one, and reports findings with tool and turn attribution.

Standard library only. It never executes a command and never contacts the network.

Rules

Rule	Severity	What it flags
SF01	critical	Pipe-to-shell / remote script execution (`curl\
SF02	critical	Destructive wipe / disk destroy (`rm -rf /`, `mkfs`, `dd of=/dev/…`)
SF03	high	Privilege escalation (`sudo`, `su -`, `doas`, `pkexec`, `runas`)
SF04	critical	Reverse shell / remote listener (`nc -e`, `bash -i >& /dev/tcp`, `ncat`)
SF05	critical	Eval of encoded or remote content (`base64\
SF06	high	Permission weakening (`chmod 777`, `chmod -R a+rwx`, `icacls Everyone:F`)
SF07	high	Dangerous git mutation (`push --force`, `reset --hard`, `clean -fdx`)
SF08	high	Publish / release / registry push (`npm publish`, `twine upload`, `docker push`)
SF09	high	Firewall / network defense change (`iptables -F`, `ufw disable`, `nft flush`)
SF10	medium	Environment / secret dump piped outbound (`printenv\
SF11	medium	Persistence install (`crontab`, systemd unit drop, LaunchAgent, `/etc/ld.so.preload`, `LD_PRELOAD=`)
SF12	info	Inventory of every observed shell command (disable in CI with `--disable SF12`)
SF13	high	AI-CLI bypass / YOLO-mode flags that disable confirmation
SF14	high	Destructive infra commands (`terraform destroy -auto-approve`, `kubectl delete --force`, `DROP … CASCADE`)
SF15	high	Authorized-keys / SSH backdoor writes
SF16	high	Secret-scanner run against a broad root plus a public exfil sink (gist, public repo)
SF17	critical	LOLBAS remote download or execute (`certutil -urlcache`, `mshta https://…`, `bitsadmin /transfer`, and similar)
SF18	critical	Download-then-execute without a pipe (`curl -o` / `wget -O`, `chmod +x`, then run the file)
SF19	critical	LOLBin / exec-trampoline or cloud-sync exfil (`tar --checkpoint-action=exec`, `forfiles /c`, MSBuild `PostBuildEvent`, rclone of `$HOME`)

Usage

python3 shellfence.py transcript.json [more.jsonl dir/ commands.txt -]
  --as-commands         treat inputs as plain command lists (one per line)
  --allow-command GLOB  fnmatch allowlist for the full command (repeatable)
  --disable RULE ...    skip rule ids (e.g. SF03 SF12)
  --json                machine-readable output
  --min-severity S      hide findings below S (default info)
  --fail-on S           exit 1 if any finding >= S (default high; any, none)
  --list-rules

After pip install of the kit, the same options work as agentsec shellfence …. Every tool also accepts --help and almost every tool accepts --json.

Example output

Flags SF01 on curl … | bash, SF02+SF03 on sudo rm -rf /, SF04 on the /dev/tcp reverse shell, SF05 on base64 -d | bash, SF06–SF08 on chmod 777 / force-push / npm publish, SF09–SF11 on firewall flush, env exfil and crontab (exit 1). examples/clean_openai.json is clean (exit 0). See also risky_anthropic.json, generic_commands.jsonl and commands.txt. All example secrets/payloads are FAKE-EXAMPLE-* or reserved documentation IPs.

python3 shellfence.py examples/risky_openai.json --disable SF12

SARIF and CI

agentsec shellfence path/to/input --sarif > shellfence.sarif

# GitHub Actions (composite action ships with the repo)
- uses: dunkleschitz/agentsec@v0
  with:
    tools: shellfence
    paths: path/to/input
    fail-on: high

SARIF 2.1.0 can be uploaded to GitHub code scanning. The composite action writes per-tool reports under agentsec-sarif/ by default.

OWASP mapping

Heuristic mapping of what this tool helps a reviewer look for. Not an official OWASP endorsement, and not complete coverage of any item. Sources: OWASP Top 10 for LLM Applications 2025 and OWASP Top 10 for Agentic Applications 2026.

ASI02 Tool Misuse and Exploitation — OWASP Agentic Top 10 (2026)
ASI05 Unexpected Code Execution (RCE) — OWASP Agentic Top 10 (2026)

Known limits

Heuristic tool-name detection. A custom tool named run_task that takes

payload may be missed unless you extract commands and pass --as-commands.

Regex detectors will miss obfuscation ($'rm\x20-rf\x20/', variables expanded

at runtime, multi-stage decode that never appears as one string in the log).

It analyzes what was saved. It cannot block a live shell; pair it with an OS

sandbox, command allowlist, or toolgate policy in front of the agent.

Benign admin workflows (intentional sudo, intentional docker push) will

match — use --allow-command or --disable for known-good patterns in CI.

Full source, tests, and fixtures: tools/shellfence/ in the repository. Install the kit with pip install git+https://github.com/dunkleschitz/agentsec.git.