AIKIDO-2026-190281

TL;DR

DashClaw's guard classifies each shell command to decide whether to allow, warn, block, or require approval before an agent runs it. The classifier only splits command chains on && and ; and inspects commands as plain text, so newline-chained and ||-chained segments, quoted command words, base64/hex decode-then-pipe-to-shell, sh -c '<string>', and flags hidden in a shell variable evade catastrophe scoring and let destructive commands such as rm -rf, find -delete, or raw block-device writes run graded as routine. Related enforcement gaps let an approval-required action proceed when approval creation fails, let an idempotency key replay a previous allow decision for a different action, and widen filesystem grant scope. The patch adds obfuscated-execution detection, splits chains on || and newlines, resolves static variable assignments before grading, binds idempotent replays to the evaluated action, and fails closed when approval creation fails.