ruvnet/ruflo · error · SafeExecutorError

DANGEROUS_PATTERN

DANGEROUS_PATTERN

Error message

Dangerous pattern detected in argument: ${arg}

What it means

SafeExecutor.validateArguments matched an argument against one of the configured blockedPatterns (compiled regex allowlist of known-dangerous substrings). The argument resembles shell metacharacters or injection payloads that could abuse the target command even without a shell, so execution is refused.

Source

Thrown at v3/@claude-flow/security/src/safe-executor.ts:271

   * @param args - Arguments to validate
   * @throws SafeExecutorError if arguments contain dangerous patterns
   */
  private validateArguments(args: string[]): void {
    for (const arg of args) {
      // Check for null bytes
      if (arg.includes('\0')) {
        throw new SafeExecutorError(
          'Null byte detected in argument',
          'NULL_BYTE_INJECTION',
          undefined,
          args
        );
      }

      // Check against blocked patterns
      for (const pattern of this.blockedPatterns) {
        if (pattern.test(arg)) {
          throw new SafeExecutorError(
            `Dangerous pattern detected in argument: ${arg}`,
            'DANGEROUS_PATTERN',
            undefined,
            args
          );
        }
      }

      // Check for command chaining attempts
      if (/^-.*[;&|]/.test(arg)) {
        throw new SafeExecutorError(
          `Potential command chaining in argument: ${arg}`,
          'COMMAND_CHAINING',
          undefined,
          args
        );
      }
    }

View on GitHub (pinned to fa13ee4ad6)

Solutions

1. Escape or remove shell metacharacters from the argument.
2. Treat the argument as data, not code: pass it via an argv array so no shell interpretation occurs.

When it happens

Trigger: Thrown at v3/@claude-flow/security/src/safe-executor.ts:271 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ruvnet/ruflo@fa13ee4ad6 (2026-08-18). Data as JSON: /api/errors/f815a00f7a97cba6. Report an issue: GitHub.