The published npm package "praisonai" ships "dist/tools/utility-tools.js", which exports a "shell(command)" helper described in source as: The helper attempts to enforce a safe read-only command allowlist by checking only the first whitespace-delimited token: It then passes the entire original string to Node "child_process.exec()": Because "exec()" runs the command through a shell, a command string that starts with an allowed command can append a second non-allowlisted command with shell metacharacters. For example, direct "printf <marker>" is rejected, but "echo ok; printf <marker>" is accepted and executes "printf". This bypasses the helper's safe-command policy and allows arbitrary shell commands to run with the PraisonAI process privileges when an application, agent, or integration exposes this helper to lower-trust users, prompts, model output, or plugin/tool input. The PoV is deterministic and local-only. It installs only the npm package, runs harmless marker commands, and does not contact any live service after installation.