shlex 2.0.1

Source: https://github.com/comex/rust-shlex
Commit scanned: e82b1411beb7 (recorded by crates.io)
Compared with: b22bb1341e3f (0 signals introduced since)
Files: 13 scanned, 13 skipped (binary, oversized, or unrecognised)
Signals: 0 critical · 0 warn · 3 info
Scan time: 4.3 s
LLM review: Reviewed by claude-haiku-5-5 (Anthropic): 3 of 3 warn and critical signals; 3 demoted to info.
Disclude version: 4.0.0
Scanned (UTC): 2026-10-14 21:07

Signals

Ordered by severity, then signals introduced in this release. Hidden characters are shown as ⟨U+…⟩.

info ~~critical~~ → info by review dynamic-execution fuzz/fuzz_quote_real_shell/each-shell.sh:62:17

`eval` called on a dynamic (variable/substitution) expression (ast pass, confidence 0.90)
```
                echo ">> ${already_set}ident='$ident' $prefix $*"
                eval "$prefix $*" || {
                    echo "FAIL: $ident"
                    exit 1
```
likely benign LLM, confidence 0.85 A fuzzing harness script that uses eval to run generated shell commands under several shells to check quoting.
Reasoning
The eval runs a prefix and arguments built by the fuzz harness, which is expected for a script that tests shell quoting across different shells. The surrounding lines print the test identifier and exit on failure, which is test-harness behaviour. There is no sign of a remote payload, encoding, or network access. The eval is risky in general, but here it is the intended mechanism of a test driver.
info ~~warn~~ → info by review dynamic-execution src/quoting_warning.md:303:3

[embedded bash] pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
```bash
$ echo -e 'ls a\xa0b' | bash
ls: a: No such file or directory
ls: b: No such file or directory
```
likely benign LLM, confidence 0.90 A documentation example in a quoting-warning article that demonstrates how piping data into bash misparses a non-breaking space.
Reasoning
This is a markdown documentation example showing that piping text into bash executes it as shell code. The snippet is an illustrative transcript of output, not code that runs against a system. It is a quoting-pitfall explanation, a legitimate pattern in documentation.
info ~~warn~~ → info by review dynamic-execution src/quoting_warning.md:309:3

[embedded bash] pipeline feeds into `bash` — piped data is executed as shell code (ast pass, confidence 0.80)
```
```bash
$ echo -e 'ls a\xa0b' | bash
ls: cannot access 'a'$'\240''b': No such file or directory
```
```
likely benign LLM, confidence 0.90 A second documentation example in the same quoting-warning article, showing the bash-pipe pitfall with different output.
Reasoning
This is the same kind of markdown illustration as the previous finding, showing a second output variant of the same pitfall. Nothing in it is executed or fetched, and it has no malicious or obfuscated content.

Reproduce This Scan

Run disclude locally to verify. Add --format sarif for SARIF output. Add --llm (with an API key in the environment) to include the LLM review.

cargo install disclude --version 4.0.0
git clone https://github.com/comex/rust-shlex rust-shlex && cd rust-shlex
git checkout e82b1411beb7c92871c2c078c9ab415bbcf207ef
disclude scan --severity info --diff b22bb1341e3f99c13347b65614f4b09e70448a0c .