{"repo":"NousResearch/hermes-agent","public_id":"98831","display_label":"key_cmd shell injection hardening via argv fixes","summary":"These items address a security concern about key_cmd executing with implicit shell invocation, with fixes focused on switching to shell=False and native argv to reduce injection risk. Multiple related fix attempts and a tracking issue are grouped here.","subsystem":"agent","counts":{"members":5,"open_issues":1,"open_issues_distinct":1,"open_prs":1,"closed_issues":0,"merged_prs":0,"attempt_prs":4},"landed_fix":null,"resolution":{"state":"unresolved","by":null},"freshness":{"state":"never_verified","last_verified_at":null,"is_stale":false},"grouping":{"backbone":"STRUCTURAL_SPANNING","link_density":0.4},"fix_edges":[],"members":[{"kind":"issue","number":98831,"title":"[P0] key_cmd implicit shell + wrapper re-entry — trusted-operator hardening (hostile-writer allowlist tracked in #98910)","url":null,"state":"open"},{"kind":"pr","number":98837,"title":"fix(security): harden key_cmd argv — trusted-operator hardening beyond 97217 (Fixes #98831, tracks #98910)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#97217","number":97217},{"kind":"pr","value":"#98831","number":98831}],"category":"wontfix_bydesign","implication":"wontfix"},"merged":false},{"kind":"pr","number":98913,"title":"fix(security): harden key_cmd argv — trusted-operator hardening beyond 97217 (Fixes #98831, tracks #98910)","url":null,"state":"open","close_reason":{"refs":[{"kind":"pr","value":"#97217","number":97217}],"category":"superseded_by_pr","implication":"superseded"},"merged":false},{"kind":"pr","number":103052,"title":"fix(security): prevent shell injection in key_cmd via shell=False on POSIX (#98831)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"commit","value":"d93ce5f44411212adb14a925a6396932042078c4","number":0},{"kind":"commit","value":"13e72fb205b735df679e0fd5f5996a34ac4accc6","number":0},{"kind":"pr","value":"#98831","number":98831},{"kind":"pr","value":"#98910","number":98910},{"kind":"pr","value":"#97217","number":97217},{"kind":"pr","value":"#98913","number":98913}],"category":"partial_fix","implication":"needs_llm"},"merged":false},{"kind":"pr","number":103695,"title":"fix(security): key_cmd runs as native argv - no shell, no wrappers (#98831)","url":null,"state":"closed","close_reason":{"refs":[{"kind":"pr","value":"#98913","number":98913}],"category":"superseded_by_pr","implication":"superseded"},"merged":false}],"trust":{"default_tier":"verified","includes_suggested":false}}