A Security-Critical Project Where I Don't Read the Code

Aaronontheweb, developer of the autonomous AI assistant Netclaw, revealed that ShellSyntaxTree (SST), a parser for bash and PowerShell commands, has been in production for months despite the author rarely reviewing its code, which is largely LLM-authored. SST powers Netclaw's human-in-the-loop approval system by extracting command patterns for auto-approval, and parsing errors could lead to unauthorized command approvals or unnecessary prompts.

12 minutes to read There’s been lots of rancor online about whether you should read and review LLM-authored code. I wanted to share a project we’ve been using in production for months where I rarely review any of it: ShellSyntaxTree https://github.com/Aaronontheweb/ShellSyntaxTree . ShellSyntaxTree is a parser that attempts to create AST representations of both bash and PowerShell commands using a shared tree representation and parser abstractions, albeit with slightly different grammars to accommodate the quirks between the scripting languages. SST is an essential tool for powering one of my other projects: Netclaw https://netclaw.dev/ - a “claw”-style autonomous AI assistant. We use SST to power Netclaw’s approval system for requesting humans to authorize commands: netclaw.dev/architecture/security-model https://netclaw.dev/architecture/security-model/ human-in-the-loop-as-a-layer-not-a-crutch . SST isn’t a security tool, but it sits inside a security decision. Netclaw auto-approves commands by matching them against pre-approved patterns - git pull, gh pr view - and SST is the layer that extracts those patterns from the raw command string. Get the parse wrong and Netclaw can auto-approve commands the user hasn’t blessed or prompt for commands the user already has.