Safety patch release: commands hidden behind variables, stdin feeds and eval are now classified by what they actually run. Classification is stricter — read the behavior change below before upgrading. Full details in CHANGELOG.md.
Fixed
These commands used to come out with no tier, and the hook allowed them as "no matching pattern". They are now CRITICAL:
X=rm; $X -rf /srv: a command word built from a provably literal script-local variable is classified as the resolved command.bash <<< "...",echo "..." | bash,base64 -d <<< ... | sh,for s in a; do cat <<< "..." | bash; done: a shell reading its program from stdin gets that program classified when it is statically known, recursively.sh -c "$(printf '...')": a-cbody built by one command substitution with a statically known result is classified.evalwith literal arguments is classified as the code it runs.
Behavior change: stricter classification
Code whose content can't be determined statically is now at least CAUTION (unresolved_execution). With the default hook_caution_action = "block", the hook blocks these commands and points to slb request. An explicit slb request treats them as DANGEROUS, and they are never auto-approved. This covers:
- computed command words that aren't script-local literals:
"$CMD" ...,$(which x) ..., and environment-derived paths such asTC=$HOME/...; $TC/bin/cargo curl ... | bash,bash < script.sh,bash <(curl ...),sh -c "$VAR ...",eval "$X"- every non-shell interpreter that reads its program from stdin:
python3 - <<'EOF' ... EOF,python - <<< ...,echo ... | perl,node -. Scripts run from a file and inline-c/-ecode are unchanged.
On a sample of 25,000 recorded agent commands, 6.5% change from no tier to CAUTION. Most are python3 - <<'PY' scripts (about 1,150) or $HOME-derived command words (about 420). No command moved to a lower tier. To be prompted instead of blocked, set integrations.hook_caution_action = "ask".
The generated offline Python hook is regex-only and does not perform this analysis. The daemon and the native hook do.
Assets
slb_0.5.2_<os>_<arch>.tar.gz (.zip on Windows) for linux/darwin amd64+arm64 and windows amd64, each with a .sha256 sidecar. SHA256SUMS and checksums.txt cover all archives, and SHA256SUMS.minisig is the minisign signature (key 1BBD79B28BF718D0, as before).