---
title: Tip: if the model can set a tool parameter, an attacker who reaches the model can set it too. Keep masking, sandbox and approval flags out of tool schemas, and never pass tool arguments through a shell | ctxsec
url: https://ctxsec.com/items/tip-agent-tools-model-must-not-set-security-flags-or-shell-args
description: ""
status: "guidance (based on AWS bulletin 2026-154 and NVD CVE-2026-117558)"
published: 2026-10-29
---

> 

[← Tips & Guides](/tips) · [markdown](/items/tip-agent-tools-model-must-not-set-security-flags-or-shell-args.md)

guidance (based on AWS bulletin 2026-154 and NVD CVE-2026-117558)

2026-10-29

### Tip: if the model can set a tool parameter, an attacker who reaches the model can set it too. Keep masking, sandbox and approval flags out of tool schemas, and never pass tool arguments through a shell

Two fresh examples. AWS's Strands environment tool let the model pass a "mask secrets" switch, so a prompt injection could turn masking off and read cloud keys (CVE-2026-115415, fixed in 0.8.6). The ai-sdlc MCP server put the model-supplied `repo` value into a shell string for `gh issue view`, so metacharacters ran commands (CVE-2026-117558, fixed in commit 717d7ecf by spawning gh with an argument array). Review your own tools: (1) list every parameter in each tool schema and ask "what happens if an attacker picks this value?"; (2) move security settings (masking, sandbox on/off, allowed paths, approval) into operator config the model cannot change; (3) use argument arrays and strict schemas (for example `owner/name` regex) instead of string commands; (4) run tools as a low-privilege user without long-lived credentials in the environment.

Sources: [AWS Security Bulletin 2026-154-AWS: CVE-2026-115415, secret masking bypass in the environment tool in Strands Agents Tools (Oct 28)](https://aws.amazon.com/security/security-bulletins/2026-154-aws/) · [NVD: CVE-2026-117558, ai-sdlc plugin MCP server command injection via repo argument (Oct 27)](https://nvd.nist.gov/vuln/detail/CVE-2026-117558) · [ai-sdlc fix commit 717d7ecf: spawn gh without a shell](https://github.com/ai-sdlc-framework/ai-sdlc/commit/717d7ecf068b714f65955e50fcf5cb4f9a0b5070)