AI Command Gates That Only Read the First Word: Why shellgate Scans the Full Command

Agents execute model-generated commands, so they need a gate that checks whether a command is dangerous. The common first version: take the first word (npm/rm/curl), look it up in a blocklist. That works for rm -rf / — and fails for:

echo rm -rf / > s.sh && bash s.sh Enter fullscreen mode Exit fullscreen mode The first word is echo. What actually runs is the disk wipe.

hmharness, an open-source agent framework for HarmonyOS/OpenHarmony development (MIT), ships a kernel-level module called shellgate that takes a different approach: scan the full command string, not a parsed fragment. Every line of a multi-line paste and every sub-command behind a pipe, redirect, or && stays inside the scan field.

Two blind spots motivated this. First, the first word does not represent the nature of a command — wrappers like echo, xargs, or nohup hide the real payload behind an innocent head word. Second, multi-line pastes: a gate that only scans line one is a gate that scans nothing, because pasting is exactly the channel people use to smuggle in longer scripts.

The granularity choice is deliberate. shellgate does not attempt full shell grammar parsing — that way lies an unmaintainable parser and endless edge cases. Instead it covers known dangerous patterns exhaustively and hands unknown patterns to a human approval gate. Scanning is the fast filter; approval is the final say. The two layers work together instead of pretending one static check can catch everything.

This sits inside a three-layer defense: fenced paste guards what goes in (multi-line pastes follow an explicit convention), shellgate guards what executes, and LSP pinning guards dependencies (sha256 so nothing gets swapped mid-flight). The layers are independent — any single one failing does not take the whole system down.

The general lesson: the scan granularity of a security gate sets its bypass cost. A gate that reads only the first word is bypassed by a single echo. A gate that scans the complete command string forces an attacker to construct an entirely new dangerous pattern — a different order of magnitude.

hmharness wires project creation, checks, builds, signing, install, launch, log reading, and result verification into a local toolchain so AI does not just generate code — it proves results against the local machine. Independent community project, no affiliation with Huawei or OpenAtom. shellgate ships in npm @hmharness/cli (CHANGELOG 0.23.16).

GitHub: https://github.com/swsgbl/hmharness · Evidence: https://swsgbl.github.io/hmharness/evidence/aisecurityopensourcecli