Precision lineage

Explicit shell-quoting helpers. @piyushdua/engram-dev wraps user input in shellQuote(record.path) before git worktree calls; that is the npm-ecosystem-standard name for shell-arg escaping. shell-quote is an npm package; shq.quote is a common alias.

JSON.stringify inside the interpolation slot. memex-mvp's launchctl unload/load calls use exactly this pattern: execSync(`launchctl unload ${JSON.stringify(PLIST_PATH)}`). JSON.stringify wraps in double quotes with proper escaping, which is shell-safe in the contexts it appears.

Declarative test-fixture markers extended. @kevinrabun/judges is a code-judging benchmark tool whose dist/commands/benchmark-expanded.js embeds dangerous-code STRING LITERALS as test fixtures. Markers like expectedRuleIds, dangerousPatterns, benchmarkCases indicate the surrounding content is corpus data, not code.

Benchmark / rules / judges file-path heuristic for detection-corpus files. Plus a meta-template marker: source containing both \\` and \\${} escape sequences in close proximity means the surrounding string is a template-literal-as-data (string content that happens to render as a template literal). Both are strong signals of fixture content.

documentation_context patterns only fire when the matched file's extension is .md, .mdx, .markdown, .rst, .txt, .adoc, or .asciidoc. findMitigators now takes a filename argument and checks the gate before testing patterns in that category. Other categories (sanitizer, test_fixture) are not file-gated.

Walk POSIX tar archive entry-by-entry, including GNU longname (L) and pax (x) extended header support. Mitigators run against the current file's content only. ~80 lines, no new dep.

Iterate every match per pattern per file (capped at 200 to bound pathological inputs). Each match's severity is computed against its own +/-2000 char window. The worst severity across all matches wins for that file. Short-circuits on the first match that remains at the pattern's original severity.

Path filter that allows source-like extensions and excludes pure artefacts (node_modules, .git, coverage, .next, *.map, *.min.js, *.d.ts). Crucially does NOT skip dist/ or build/ — in published npm tarballs those are usually the actual executable code.

Extended the existing database-method allowlist to include `this.exec(`. s3db.js's remote-sqlite-client calls `this.exec(\`SELECT ...\`, [params])` for SQL, not shell.

Compile-time identifiers within scope. safari-mcp's postinstall used `path.join(__dirname, '..', 'safari-helper')` and the regex treated that as user input.

ALL_CAPS interpolated identifiers strongly signal a compile-time constant. s3db.js's `${REPO_URL}` is a hardcoded repository URL.

Numeric coercion. A value passed through Number(), parseInt(), or parseFloat() cannot carry shell metacharacters.

Properties guaranteed to be numeric. claude-flow's webhook example uses `${event.pull_request.number}` which is always an integer from GitHub.

Code-signing toolchain. Postinstall scripts in macOS/Windows helper packages invoke these against package-internal binaries, never user input.

Auto-update scripts querying npm for known dependency names from package.json.

Triple-backtick code fences. Markdown documentation routinely contains example code, including anti-pattern examples.

Markdown anti-pattern markers. claude-flow's v3-security-architect.md literally labelled the example shell-exec line `❌ Dangerous: shell injection possible` and the scanner caught the tutorial.

English comment annotations marking code as an anti-pattern.

Markdown headings within scope. Strong signal the surrounding context is documentation, not executable source.

HTML / JSX comments commonly used in README, MDX, and docs.

SQL keyword immediately after .exec(. Strong signal this is a database method, not child_process.exec.

Database-shaped variable names calling .exec, like better-sqlite3, pg, mysql2, prisma raw queries.

Files like selfEvalTools.js, llmJudgeEval.js, pipelineEval.js. The word eval refers to evaluation flow, not JavaScript eval.

Strings being pushed into a recommendations or messages array are message text, not executable code.

console.log and friends emitting strings that contain the word eval.

Canonical fake-credential placeholders. claude-flow used sk-abc123-style test keys.

Long repeating placeholder sequences like abcdabcdabcd.

Declarative fixture structure: { params: { ... }, expectedOutcome: 'deny' }. Pure data, not exploitable code.

Test-shaped predicate names sitting near otherwise-dangerous-looking literals.

Validator and sanitizer source files contain example dangerous strings by design.

Direct match for the wrapper Agions introduced.

Common naming convention for input sanitizers across the ecosystem.

Whitelist-style guards.

execFile with an args array cannot shell-interpret. Different posture from exec.

spawn('cmd', [args]) array form bypasses the shell entirely.