UAT: TUI shell danger detection — rm -rf and fork bomb misclassified as CRITICAL; spec table defines max level as High #6821

New issue

Open

opened 2026-04-10 02:15:30 +00:00 by HAL9000 · 0 comments

HAL9000 commented

2026-04-10 02:15:30 +00:00

Owner

Bug Report

Feature Area: TUI — Shell Mode / Shell Danger Detection
Spec Reference: §TUI — Shell Danger Detection (pattern table)

Summary

The spec's shell danger detection table defines only three risk levels: Low, Medium, and High. The implementation adds a fourth level (CRITICAL) and assigns rm -rf and fork bomb patterns to it, contradicting the spec table which classifies both as High.

Spec Requirements

The spec's shell danger detection pattern table explicitly states:

Pattern	Risk Level
`rm -rf` / `rm -r`	High
`:(){ :\|:& };:` (fork bomb)	High

The spec table shows only three risk levels across all patterns: Low, Medium, and High. No Critical level appears in the spec table.

What Was Found

File: src/cleveragents/tui/shell_safety/danger_level.py and pattern_registry.py

ShellDangerLevel defines four levels: LOW, MEDIUM, HIGH, CRITICAL.

In pattern_registry.py, the following patterns are assigned ShellDangerLevel.CRITICAL:

rm_rf_root → CRITICAL (rm -rf /)
rm_rf_wildcard → CRITICAL (rm -rf * / rm -rf /path)
fork_bomb → CRITICAL (:(){ :|:& };:)

But the spec table assigns both rm -rf / rm -r and fork bomb patterns to risk level High, not Critical. The CRITICAL level does not appear anywhere in the spec's danger detection section.

Impact

The ShellSafetyService defaults to block_level=ShellDangerLevel.MEDIUM, meaning anything at CRITICAL would behave differently from HIGH when custom block_level settings are used. More importantly, the danger levels used in UI highlighting and warning messages do not match the spec's prescribed categorization.

Steps to Reproduce

Open docs/specification.md, find "Shell Danger Detection" table
Note rm -rf and fork bomb are listed as High risk
Open src/cleveragents/tui/shell_safety/pattern_registry.py
Find rm_rf_root, rm_rf_wildcard, fork_bomb — all are ShellDangerLevel.CRITICAL
Confirm the spec has no Critical tier in its danger table

Expected Behavior

The ShellDangerLevel enum should only define the three levels present in the spec: LOW, MEDIUM, HIGH. The rm -rf and fork bomb patterns should be classified as HIGH, not CRITICAL. Alternatively, if CRITICAL is a valid extension, the spec should be updated to reflect it.

Automated by CleverAgents Bot
Supervisor: UAT Testing | Agent: uat-tester

## Bug Report **Feature Area**: TUI — Shell Mode / Shell Danger Detection **Spec Reference**: §TUI — Shell Danger Detection (pattern table) ### Summary The spec's shell danger detection table defines only three risk levels: `Low`, `Medium`, and `High`. The implementation adds a fourth level (`CRITICAL`) and assigns `rm -rf` and fork bomb patterns to it, contradicting the spec table which classifies both as `High`. ### Spec Requirements The spec's shell danger detection pattern table explicitly states: | Pattern | Risk Level | |---------|-----------| | `rm -rf` / `rm -r` | **High** | | `:(){ :\|:& };:` (fork bomb) | **High** | The spec table shows only three risk levels across all patterns: `Low`, `Medium`, and `High`. No `Critical` level appears in the spec table. ### What Was Found **File**: `src/cleveragents/tui/shell_safety/danger_level.py` and `pattern_registry.py` `ShellDangerLevel` defines **four** levels: `LOW`, `MEDIUM`, `HIGH`, `CRITICAL`. In `pattern_registry.py`, the following patterns are assigned `ShellDangerLevel.CRITICAL`: - `rm_rf_root` → CRITICAL (`rm -rf /`) - `rm_rf_wildcard` → CRITICAL (`rm -rf *` / `rm -rf /path`) - `fork_bomb` → CRITICAL (`:(){ :|:& };:`) But the spec table assigns both `rm -rf` / `rm -r` and fork bomb patterns to risk level **High**, not Critical. The CRITICAL level does not appear anywhere in the spec's danger detection section. ### Impact The `ShellSafetyService` defaults to `block_level=ShellDangerLevel.MEDIUM`, meaning anything at CRITICAL would behave differently from HIGH when custom `block_level` settings are used. More importantly, the danger levels used in UI highlighting and warning messages do not match the spec's prescribed categorization. ### Steps to Reproduce 1. Open `docs/specification.md`, find "Shell Danger Detection" table 2. Note `rm -rf` and fork bomb are listed as **High** risk 3. Open `src/cleveragents/tui/shell_safety/pattern_registry.py` 4. Find `rm_rf_root`, `rm_rf_wildcard`, `fork_bomb` — all are `ShellDangerLevel.CRITICAL` 5. Confirm the spec has no `Critical` tier in its danger table ### Expected Behavior The `ShellDangerLevel` enum should only define the three levels present in the spec: `LOW`, `MEDIUM`, `HIGH`. The `rm -rf` and fork bomb patterns should be classified as `HIGH`, not `CRITICAL`. Alternatively, if `CRITICAL` is a valid extension, the spec should be updated to reflect it. --- **Automated by CleverAgents Bot** Supervisor: UAT Testing | Agent: uat-tester

Rows
Columns