Tell whether a shell command really runs a program — a fail-closed deny-list that sees through quotes, here-documents, $(…), bash -c, env, sudo and xargs
shell bash zsh hook security parser command guard heredoc command-parser deny-list ai-agent denylist claude-code pre-tool-use
-
Updated
Oct 17, 2026 - TypeScript