Your Agent's Shell Allowlist Is Bypassable
A permission gate for AI agents' shell commands judged spellings instead of commands. I found several classes of bypass in shipmates' own gate, and one idea fixes most of them.
Every shipmates crew member runs shell commands. Before any of
them runs, it goes through a permission gate. The gate uses the same rule syntax as Claude Code settings:
Bash(git status), Bash(rm *), Write(**/.claude/settings.json). The rules are merged from several layers:
