overprivileged_agent_tool

Validate or allow-list the tool argument before the dangerous call medium effort

# Before (VULNERABLE): the model-chosen arg goes straight to the shell
@tool
def run_command(cmd: str) -> str:
    return os.popen(cmd).read()

# After (SAFE): fixed allow-list — the model can only pick, not compose
ALLOWED = {"status": ["git", "status"], "log": ["git", "log", "-5"]}
@tool
def run_command(action: str) -> str:
    argv = ALLOWED.get(action)
    if argv is None:
        raise ValueError(f"unknown action: {action}")
    return subprocess.run(argv, capture_output=True, text=True).stdout

Split the tool: dangerous operations take only tool-internal constants medium effort

Suppress a confirmed non-issue with a committed .pullguardignore entry (pullguard ignore locally, or comment /pullguard ignore <fingerprint> <reason> on the PR — the fingerprint is printed in the PR comment’s Triage section). Entries support expiresAt for time-boxed snoozes.

Security findings at major or critical severity — and any critical finding — always surface: .pullguardignore cannot hide them. The reviewed paths that keep them visible are acknowledged (reviewed, stays in reports) and, for a confirmed false positive, a reasoned false_positive entry — visible and audited, excluded only from the merge block.