ruvnet/ruflo · error · SafeExecutorError

COMMAND_CHAINING

COMMAND_CHAINING

Error message

Potential command chaining in argument: ${arg}

What it means

SafeExecutor.validateArguments detected an argument beginning with '-' that also contains ';', '&', or '|' — the signature of trying to combine an option flag with command chaining to smuggle a second command past the shell-less exec. The execution is refused rather than attempting to sanitize.

Source

Thrown at v3/@claude-flow/security/src/safe-executor.ts:282

          args
        );
      }

      // Check against blocked patterns
      for (const pattern of this.blockedPatterns) {
        if (pattern.test(arg)) {
          throw new SafeExecutorError(
            `Dangerous pattern detected in argument: ${arg}`,
            'DANGEROUS_PATTERN',
            undefined,
            args
          );
        }
      }

      // Check for command chaining attempts
      if (/^-.*[;&|]/.test(arg)) {
        throw new SafeExecutorError(
          `Potential command chaining in argument: ${arg}`,
          'COMMAND_CHAINING',
          undefined,
          args
        );
      }
    }
  }

  /**
   * Sanitizes a single argument.
   *
   * @param arg - Argument to sanitize
   * @returns Sanitized argument
   */
  sanitizeArgument(arg: string): string {
    // Remove null bytes
    let sanitized = arg.replace(/\0/g, '');

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Split chained commands into separate executor calls.
2. Reject arguments containing ; && || | and execute each step independently with validated commands.

When it happens

Trigger: Thrown at v3/@claude-flow/security/src/safe-executor.ts:282 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/9d312530cd0bc18f. Report an issue: GitHub.