Omnigent Shell-Command Parser Bypass Enabling Policy Confinement Escape

Technical Analysis

The vulnerability lies in omnigent/policies/builtins/_shell.py, which parses shell commands to extract the underlying operation so that downstream policies (github.py write_repos/write_branches allowlists, working_dir.py workspace confinement) can evaluate and gate them. The parser does not recognize commands wrapped in timeout, nice, setsid, or stdbuf, nor commands using combined interpreter flags, command substitution ($(...) or backticks), or a single background control operator (&). When such forms are used, the parser returns no recognized operation, and the policy engine defaults to an 'abstain' state that allows the command through unchecked rather than failing closed. An attacker who can influence agent-issued shell commands—either a malicious/compromised user or an agent manipulated via prompt injection during autonomous coding tasks—can wrap a git push or gh command in one of these unrecognized forms to bypass the repository/branch allowlist or break out of the workspace directory confinement, gaining unauthorized write access to git repositories or the host filesystem. This crosses the tool-execution boundary between the agent's reasoning layer and the shell/tool layer, converting a policy-enforcement gap into a full authorization bypass.

Affected Systems

Omnigent

Detection Signatures

• Shell commands invoking git push or gh wrapped in timeout, nice, setsid, or stdbuf
• Command strings containing command substitution syntax ($(...) or backticks) alongside git/gh operations
• Combined/concatenated interpreter flags (e.g., -c combined with other short flags) preceding git or gh invocations
• Commands ending in a background control operator (&) that also contain repository write operations
• Policy engine logs showing 'abstain' or 'no operation parsed' decisions immediately preceding a git push or branch write
• Unexpected writes to repositories/branches not present in the configured allowlist
• Workspace directory confinement policy logs indicating no match found for an executed command

Remediation Steps

1. 1

   Upgrade Omnigent

   Update to Omnigent version 0.3.0 or later, which fixes the shell-command parser to correctly recognize wrapped and composite command forms.

2. 2

   Fail closed on unparsed commands

   Configure or patch policy engines so that any command the parser cannot fully classify results in a deny-by-default outcome rather than an abstain-to-allow outcome.

3. 3

   Audit historical logs

   Review agent execution logs for git push, gh, or shell commands using timeout/nice/setsid/stdbuf wrappers, command substitution, or background operators to identify potential past policy bypasses.

4. 4

   Constrain agent shell execution

   Restrict coding agents to a vetted, minimal command allowlist or use a proper shell AST parser instead of pattern/regex-based recognition for security-critical policy gating.

5. 5

   Defense-in-depth workspace isolation

   Enforce workspace confinement at the OS/container level (e.g., chroot, namespaces, restricted filesystem permissions) so a parser bypass alone cannot achieve directory escape.