Claude's static analysis for Bash commands now includes comprehensive awk program inspection. The following patterns are detected and flagged:
system()— executes arbitrary shell commands- Command pipes:
| "cmd"or| getline— executes arbitrary commands @load/@include/@indirectcalls — loads extensions or executes indirectlyextension()(legacy gawk) — loads arbitrary native code- gawk
/inet/network sockets — can exfiltrate data - Unquoted glob characters in awk arguments
- Arguments with runtime-determined program text (prevents static analysis)
--file/--sourceflags (program from file, cannot be statically analyzed)
Evidence
New awk checker (search for "awk program contains system() which executes arbitrary commands")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.