FoundationAgents/OpenManus · warning · ValueError

Command contains potentially dangerous operation: {risky}

Error message

Command contains potentially dangerous operation: {risky}

What it means

The command sanitizer in DockerSession rejects commands whose text contains any entry of a hardcoded blocklist ('rm -rf /', 'mkfs', 'dd if=/dev/zero', fork bomb, 'chmod -R 777 /', 'chown -R'). It is a naive substring match on the lowercased command, so it fires on exact patterns and — notably — on ANY recursive chown ('chown -R' is matched without a target), producing false positives for legitimate operations.

Source

Thrown at app/sandbox/core/terminal.py:244

        Raises:
            ValueError: If command contains potentially dangerous patterns.
        """

        # Additional checks for specific risky commands
        risky_commands = [
            "rm -rf /",
            "rm -rf /*",
            "mkfs",
            "dd if=/dev/zero",
            ":(){:|:&};:",
            "chmod -R 777 /",
            "chown -R",
        ]

        for risky in risky_commands:
            if risky in command.lower():
                raise ValueError(
                    f"Command contains potentially dangerous operation: {risky}"
                )

        return command


class AsyncDockerizedTerminal:
    def __init__(
        self,
        container: Union[str, Container],
        working_dir: str = "/workspace",
        env_vars: Optional[Dict[str, str]] = None,
        default_timeout: int = 60,
    ) -> None:
        """Initializes an asynchronous terminal for Docker containers.

        Args:
            container: Docker container ID or Container object.

View on GitHub (pinned to 52a13f2a57)

Solutions

1. Rephrase the blocked operation: use scoped targets ('rm -rf /workspace/build') instead of root-level patterns.
2. Replace 'chown -R user:user /path' with a non-blocked equivalent (e.g. run as the right user from the start, or 'find /path -exec chown user:user {} +') — or patch the blocklist to match 'chown -R' only with dangerous targets.
3. Catch ValueError at the call site and report the rejected pattern back to the command source (LLM/agent) so it can rephrase instead of crashing the tool.
4. Never try to bypass by obfuscation; if the pattern is legitimate, amend the sanitizer's list in your fork with tests.

Example fix

# before
await term.execute("chown -R appuser:appuser /workspace")  # ValueError: dangerous operation 'chown -R'

# after
await term.execute("find /workspace -exec chown appuser:appuser {} +")

# or narrow the blocklist:
risky_commands = ["rm -rf /", "rm -rf /*", "mkfs", "dd if=/dev/zero", ":(){:|:&};:", "chmod -R 777 /"]  # drop bare 'chown -R'

BLOCKLIST = ('rm -rf /', 'rm -rf /*', 'mkfs', 'dd if=/dev/zero', ':(){:|:&};:', 'chmod -R 777 /', 'chown -R')
def is_sanitized(cmd: str) -> bool:
    low = cmd.lower()
    return not any(p in low for p in BLOCKLIST)

try:
    out = await term.execute(cmd)
except ValueError as e:
    if 'potentially dangerous' in str(e):
        # feed the rejected pattern back to the command source to rephrase
        cmd = rephrase(cmd, str(e))
        out = await term.execute(cmd)
    else:
        raise

When it happens

Trigger: Passing any command containing 'chown -R' (e.g. 'chown -R user:user /workspace'), or one of the destructive patterns. Also fires when a benign command merely embeds a blocklisted substring in a string argument or filename.

Common situations: Build steps that fix ownership inside the container; docs/scripts quoted inside an echoed string; agent-generated cleanup commands that legitimately match 'rm -rf /some/path' (only 'rm -rf /' and 'rm -rf /*' are blocked, so 'rm -rf /workspace/tmp' is fine, but quoting quirks can still match).

Related errors

• Server URL is required for SSE connection
• Command is required for stdio connection
• Unsupported connection type: {self.connection_type}
• Tool calls required but none provided
• Failed to load MCP server config: {e}

AI-assisted analysis of FoundationAgents/OpenManus@52a13f2a57 (2026-08-15). Data as JSON: /api/errors/9bca8d60f80f8f4f. Report an issue: GitHub.