{"version":"2.1.64","anchor":"bash-command-security-checks","canonical_anchor":"bash-command-security-checks","heading":"Bash Command Security Checks","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.64\/e\/bash-command-security-checks","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.64","markdown":"### Bash Command Security Checks\n\n**What**\n\nNew security checks detect and flag potentially obfuscated bash commands that could bypass permission checks.\n\n**Details**\n\n- Detects commands containing quoted newlines followed by `#`-prefixed lines, which can hide arguments from line-based permission scanning\n- Detects consecutive quote characters at word start (potential obfuscation)\n- Detects empty quote pairs adjacent to quoted dashes (flag obfuscation)\n- Sanitizes redirects to Windows `NUL` device by replacing with `\/dev\/null`\n- Flagged commands trigger an \"ask\" behavior requiring explicit user approval\n\n**Evidence**\n\nSecurity checks (search for `\"potential obfuscation\"`, `\"quoted newline\"`, `\"$1\/dev\/null\"`)"}