What
New command safety checks that detect and flag potentially dangerous shell expansion patterns before execution.
Details
- Zsh equals expansion (
=cmd): Detects commands containing zsh=cmdsyntax, which could unexpectedly expand to command paths - Bash array subscript injection: Flags commands where
$(cmd)appears inside[[ ... ]]array subscripts, which bash arithmetically evaluates — a known injection vector
Evidence
Shell safety checks (search for "Zsh equals expansion (=cmd)" and "bash arithmetically evaluates")
Strings lifted out of the shipped bundle, so the claim above can be checked against them.