Submit #865115: HKUDS nanobot 0.2.1 Allowlist Bypass via Wrapper Prefix (CWE-184)

# Technical Details
A wrapper-prefix allowlist bypass exists in the `ExecTool._guard_command` method in `nanobot/agent/tools/shell.py` of nanobot.

The application fails to normalize or unwrap shell-wrapper forms before validating `exec.allow_patterns`. If an operator uses a permissive prefix rule matching `env bash -lc 'echo allowlisted`, nanobot approves a longer payload such as `env bash -lc 'echo allowlisted && touch canary-created'`, then passes the entire string to `bash -c`, where the nested shell interprets the appended `&& touch ...` segment.

# Vulnerable Code
File: nanobot/agent/tools/shell.py
Method: ExecTool._guard_command() / ExecTool._spawn()
Why: The allowlist decision is made on the raw wrapper string instead of the effective shell payload, and the same unmodified string is executed by the shell, allowing appended operators inside the nested wrapper command to run.

# Reproduction
1. Configure nanobot 0.2.1 with the `exec` tool enabled and an allowlist prefix like `env\\s+bash\\s+-lc\\s+'echo\\s+allowlisted`.
2. Trigger `env bash -lc 'echo allowlisted && touch canary-created'` through the real `ToolRegistry` or the provided verification PoC.
3. Observe that the command returns `Exit code: 0` and creates the canary file, while an exact-match allowlist control blocks the same payload.

# Impact
- A caller who can reach the `exec` path can smuggle extra shell commands inside an apparently allowlisted wrapper.
- Operator trust in wrapper-based allowlists is broken, allowing unauthorized file changes or follow-on execution in the workspace.

• Source: ⚠️ https://gist.github.com/YLChen-007/8e02c675081d56b522f92d251a568295
• User: Eric-c (UID 96848)
• Submission: 06/22/2026 04:17 (2 months ago)
• Moderation: 08/07/2026 14:07 (2 months later)
• Status: Duplicate
• VulDB entry: 386997 [HKUDS nanobot up to 0.2.1 Shell Allowlist shell.py ExecTool._guard_command/ExecTool._spawn os command injection]
• Points: 0