OliveTin gives access to predefined shell commands from a web interface. The "filterToDefinedArgumentsOnly" function in the executor is intended to discard any arguments not explicitly defined in the action's configuration. However, prior to commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d, a special case allows any argument whose name starts with "ot_" to bypass this filter. While two system arguments ("ot_executionTrackingId" and "ot_username") are injected by OliveTin and overridden, all other "ot_"-prefixed arguments supplied by the user pass through unmodified. These bypassed arguments are not type-checked — the validation loop only iterates over the action's defined arguments, so "ot_"-prefixed arguments skip all type safety checks entirely; set as environment variables — via "buildEnv()", with completely unvalidated values, and passed to the executed command; and included in the template context — available as ".Arguments.ot_*" in template rendering. Commit ebffd9f040f791208aee1db2e5a8aecd1e3e603d contains a patch.