What happened?
The validatePrompt() function in packages/cli/src/security.ts uses a blocklist of regex patterns intended to prevent shell injection. However, several patterns are broad enough to reject perfectly valid natural-language prompts that developers would reasonably send to an AI coding agent.
Examples of blocked legitimate prompts
"Fix the merge conflict >> registration flow" — caught by the >> redirection pattern"Run tests && deploy if they pass" — caught by the && chaining check"The output where X > Y is slow" — caught by > redirection pattern"Add a heredoc to the Dockerfile" — caught by the << heredoc pattern
Why this is a problem
The prompt is not executed as a shell command — it is passed to a remote AI agent. The security concern (preventing shell injection into the spawn CLI itself, e.g. via argument quoting) is valid, but the current implementation validates the semantic content of what the user wants to ask the agent, not just the transport-layer safety of the string.
This creates a confusing UX where spawn refuses to process queries that contain common programming terminology (>>, &&, >, heredocs) simply because those characters appear in natural language.
Suggested fix
- Scope the validation more narrowly to the string as it will be embedded (e.g., check after escaping/quoting, not before)
- Or: validate only the CLI argument transport path rather than the full prompt content
- At minimum, add tests that assert common developer phrasings are not rejected
Notes
Filed from Slack by Ori
What happened?
The
validatePrompt()function inpackages/cli/src/security.tsuses a blocklist of regex patterns intended to prevent shell injection. However, several patterns are broad enough to reject perfectly valid natural-language prompts that developers would reasonably send to an AI coding agent.Examples of blocked legitimate prompts
"Fix the merge conflict >> registration flow"— caught by the>>redirection pattern"Run tests && deploy if they pass"— caught by the&&chaining check"The output where X > Y is slow"— caught by>redirection pattern"Add a heredoc to the Dockerfile"— caught by the<<heredoc patternWhy this is a problem
The prompt is not executed as a shell command — it is passed to a remote AI agent. The security concern (preventing shell injection into the
spawnCLI itself, e.g. via argument quoting) is valid, but the current implementation validates the semantic content of what the user wants to ask the agent, not just the transport-layer safety of the string.This creates a confusing UX where spawn refuses to process queries that contain common programming terminology (
>>,&&,>, heredocs) simply because those characters appear in natural language.Suggested fix
Notes
Filed from Slack by Ori