Skip to content
Sarj Sarj Sarj Standards

no-unsafe-command-argument-interpolation

raw Claude command argument interpolated into an executable shell or query fence

SARJ307 Rule source Tests Catalog JSON

Why

Slash-command arguments are user-controlled. Embedding them into a shell token or query string can change command structure or query semantics when the documented command is executed.

Fix

Pass the argument as its own quoted shell token to a wrapper that validates or parameterizes it; never splice it into SQL, LogQL, or another query string.

Examples

Before — flagged Do not splice command arguments into queries
.claude/commands/lookup.md
```sql
SELECT
  id
FROM
  records
WHERE
  id = '$ARGUMENTS';
```
After — preferred Pass an opaque argument to a validating wrapper
.claude/commands/lookup.md
```bash
scripts/lookup.sh "$ARGUMENTS"
```

Files

.claude/commands/*.md