davila7/claude-code-templates · critical

SEM_E006

SEM_E006

Error message

Shell access attempt detected

What it means

SEM_E006 is a critical semantic finding matching /(open|spawn|exec|run)\s+(a\s+)?(shell|terminal|bash|cmd|powershell)/gi. It flags instructions that direct the agent to open or spawn an interactive shell — a common injection goal because a shell grants arbitrary command execution. The validator reports it whenever the phrase appears in validated component content.

Source

Thrown at cli-tool/src/validation/validators/SemanticValidator.js:53

        code: 'SEM_E003',
        message: 'Role manipulation detected: Attempt to redefine AI role',
        severity: 'high'
      },
      {
        pattern: /execute\s+the\s+following\s+(code|command|script)/gi,
        code: 'SEM_E004',
        message: 'Command execution attempt detected',
        severity: 'critical'
      },
      {
        pattern: /\b(fetch|retrieve|get|extract|obtain|steal|harvest|capture|collect)\s+(the\s+)?(user['']?s?\s+)?(auth\s+)?(token|key|password|credential|secret|api[\s_-]?key)/gi,
        code: 'SEM_E005',
        message: 'Credential harvesting pattern detected',
        severity: 'critical'
      },
      {
        pattern: /(open|spawn|exec|run)\s+(a\s+)?(shell|terminal|bash|cmd|powershell)/gi,
        code: 'SEM_E006',
        message: 'Shell access attempt detected',
        severity: 'critical'
      },
      {
        pattern: /(disable|bypass|override|skip)\s+(security|safety|filter|protection|validation)/gi,
        code: 'SEM_E007',
        message: 'Security bypass attempt detected',
        severity: 'critical'
      },
      {
        pattern: /always\s+(obey|follow|comply\s+with|execute)\s+the\s+user/gi,
        code: 'SEM_E008',
        message: 'Unconditional obedience instruction detected',
        severity: 'high'
      },
      {
        pattern: /(forget|disregard|remove)\s+(everything|all\s+previous|prior\s+context)/gi,
        code: 'SEM_E009',

View on GitHub (pinned to a0851ed10c)

Solutions

1. Rephrase to non-imperative guidance: 'Terminal commands can be run in the user's shell of choice' or instruct via a specific tool call
2. Name the concrete command instead of the shell: 'Run `npm test` in the project directory' rather than 'open a bash shell'
3. Paraphrase quoted transcripts that contain the exact phrase
4. Waive via review pipeline if shell access is the component's documented, intended purpose

Example fix

// before
Open a terminal and navigate to the project directory.

// after
Run commands from the project directory (e.g. `cd ~/project && npm test`).

const SHELL_RE = /(open|spawn|exec|run)\s+(a\s+)?(shell|terminal|bash|cmd|powershell)/i;
function requestsShell(text) { return SHELL_RE.test(text); }
if (requestsShell(content)) warn('Describe concrete commands instead of spawning shells.');

function isSafeShellText(text) { return !/(open|spawn|exec|run)\s+(a\s+)?(shell|terminal|bash|cmd|powershell)/i.test(text); }

When it happens

Trigger: Content containing 'open a terminal', 'spawn a shell', 'run bash', 'exec powershell', etc. (case-insensitive; the article 'a' is optional so 'open terminal' also matches). Typical in DevOps-oriented agents, setup instructions, or quoted terminal transcripts.

Common situations: Terminal/DevOps agent components whose instructions naturally say 'open a terminal and run ...'; onboarding docs embedded in components; tutorial components copied from blog posts.

Related errors

• SEM_E003
• SEM_E004
• SEM_E005
• SEM_E007
• SEM_E008

AI-assisted analysis of davila7/claude-code-templates@a0851ed10c (2026-08-28). Data as JSON: /api/errors/bb2cc81bfde6b247. Report an issue: GitHub.