quote — Atropos Observatory

Quotes a shell argument for a specific shell grammar. This is a sanitizer, not proof that the overall command is safe.

Argument map · what each slot does

The pack does not provide a callable signature for this record; the watched access path is shown directly.

Arg	Access path	Purpose	Watched
Argument[0]	Argument[0]	The access path Atropos marks for this model.	▲ sanitizer

The weakness

CWE-78 ↗

OS Command Injection

External input alters the syntax or behavior of an operating-system command.

What goes wrong

Attacker's-eye view · command-injection

An attacker adds separators, substitutions, or flags that turn a value into a second command or alter the first.

// modeled boundary: Argument[0] -> ReturnValue quote(attacker_influenced_value);

To decide if this call is a bug, check

1Use a fixed executable and argument array.

2Keep shell parsing disabled where possible.

3Validate executable and argument domains.

These checks require the surrounding codebase. The model names the boundary; it does not decide reachability or prove that a guard dominates every path.

Is this a bug in your code?Atropos stops here — by design

Atropos identifies Argument[0] -> ReturnValue as a command-injection sanitizer. It cannot see whether untrusted data reaches this call in your repository.

Lachesis is the codebase-level step: it traces reachability and guards for this symbol.

Check this symbol in Lachesis →

Reviewed guidance

Safer direction: Prefer removing the shell boundary entirely; quote only as a constrained compatibility measure.

Unsafe shape

exec('tool ' + userInput);

Safer shape

exec('tool ' + quote(userInput));

The family · command-injection

Model facts · verbatim from the pack

Role	Kind	Access path	Model ID	Confidence
sanitizer	command-injection	`Argument[0] -> ReturnValue`	`javascript.shell-quote.quote.a0-ret`	medium · corrob. 2

Referencesgithub.com ↗

Same behavior

Across languages

What neutralizes it