wenjin272 opened a new issue, #1004: URL: https://github.com/apache/flink-agents/issues/1004
### Description The built-in Bash tool currently validates the executable name of each command against `allowed_commands` or `allowed_script_dirs`, but it does not constrain file redirect destinations. The accepted AST also allows environment-variable assignments that can change how an otherwise allowed command executes. As a result, a narrow command allowlist does not currently imply a narrow filesystem or execution boundary. For example, a command using an allowed executable can redirect output to any path writable by the TaskManager process. Materialized skill directories are also automatically added to `allowed_script_dirs`, so writable files in those directories deserve additional protection. Flink Agents is currently in the experimental 0.x release series and does not provide production-readiness guarantees. This issue tracks the hardening needed before production readiness / 1.0. ### Expected behavior - Define and document the Bash allowlist's security contract explicitly. - Reject file redirects by default, or validate their destinations against a separate, explicitly configured set of writable directories. Executable directories should not implicitly become writable directories. - Reject or safely constrain environment assignments that alter command resolution or execution behavior, such as `PATH`, `BASH_ENV`, and dynamic-loader variables. - Make materialized skill content immutable or read-only where practical, as defense in depth. - Keep validation behavior aligned across Java and Python. - Add focused tests covering redirects inside and outside permitted write locations, behavior-changing environment assignments, and normal pipes / descriptor redirects that remain supported. - Update the skills and Bash tool documentation so that the allowlist's guarantees and limitations are clear. ### How to reproduce Without executing a command, call the Java or Python Bash validator with: ```text command: echo hi > /tmp/out allowed_commands: [echo] allowed_script_dirs: [] ``` The validator currently accepts the command even though the redirect destination is outside every allowed directory. Existing Java and Python unit tests also pin this behavior. ### Version and environment Confirmed in Apache Flink Agents 0.3.1 and on `main` as of 2026-08-12, in both the Java and Python implementations. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
