ruvnet/ruflo · error · SafeExecutorError

DANGEROUS_COMMAND_ALLOWED

DANGEROUS_COMMAND_ALLOWED

Error message

Dangerous commands cannot be allowed: ${dangerousAllowed.join(', ')}

What it means

SafeExecutor config validation: one or more entries in allowedCommands have a basename present in DANGEROUS_COMMANDS (e.g. rm, sh). The allowlist is meant to be a safe subset of executables; allowing inherently dangerous commands would defeat the executor's purpose, so construction is refused and the offending names listed.

Source

Thrown at v3/@claude-flow/security/src/safe-executor.ts:210

  /**
   * Validates executor configuration.
   */
  private validateConfig(): void {
    if (this.config.allowedCommands.length === 0) {
      throw new SafeExecutorError(
        'At least one allowed command must be specified',
        'EMPTY_ALLOWLIST'
      );
    }

    // Check for dangerous commands in allowlist
    const dangerousAllowed = this.config.allowedCommands.filter(
      cmd => DANGEROUS_COMMANDS.includes(path.basename(cmd))
    );

    if (dangerousAllowed.length > 0) {
      throw new SafeExecutorError(
        `Dangerous commands cannot be allowed: ${dangerousAllowed.join(', ')}`,
        'DANGEROUS_COMMAND_ALLOWED'
      );
    }
  }

  /**
   * Validates a command against the allowlist.
   *
   * @param command - Command to validate
   * @throws SafeExecutorError if command is not allowed
   */
  private validateCommand(command: string): void {
    const basename = path.basename(command);

    // Check if command is allowed
    const isAllowed = this.config.allowedCommands.some(allowed => {
      const allowedBasename = path.basename(allowed);

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Remove the listed dangerous commands from the allowlist.
2. If a dangerous command is genuinely required, use a dedicated audited wrapper instead of the generic executor.

When it happens

Trigger: Thrown at v3/@claude-flow/security/src/safe-executor.ts:210 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/a6d751d9b6ba2bfa. Report an issue: GitHub.