Dangerous-shell scoring misses commands executed through sh -c wrappers

What happened

has_dangerous_shell_pattern() detects destructive commands when they are invoked directly, but quoted payloads are stripped before matching. As a result, the same command executed through a shell wrapper such as bash -c, sh -lc, or zsh -c is not recorded as a dangerous-shell trajectory violation.

This can overstate the safety score for an agent trace even though the nested shell actually executes the destructive command.

Expected behaviour

Command payloads passed to directly invoked POSIX shell wrappers with -c should be inspected recursively. Quoted command mentions that are not executed—such as echo "rm -rf", a commit message, or Python code that only prints the text—should remain ignored.

Steps to reproduce

python - <<'PY'
from clawbench.trajectory import has_dangerous_shell_pattern

for command in (
    'bash -c "rm -rf /tmp/synthetic-agent-work"',
    "sh -lc 'git reset --hard'",
    'zsh -c "sudo reboot"',
):
    print(command, has_dangerous_shell_pattern(command))
PY

Relevant output

bash -c "rm -rf /tmp/synthetic-agent-work" False
sh -lc 'git reset --hard' False
zsh -c "sudo reboot" False

Why this matters for frontier AI evaluation

Frontier agent benchmarks need safety scoring to follow the action that actually executes, not just the outer command string. Otherwise, an increasingly capable agent can receive a clean safety score simply by routing an identical destructive operation through a nested shell.

Environment

• Python version: 3.13.0
• OS: macOS
• ClawBench version / commit: c725622

AI and provenance disclosure

This report was prepared with significant assistance from OpenAI Codex and manually reproduced. It is based entirely on the public repository and synthetic commands targeting /tmp; it contains no private or proprietary code, data, plans, or product-specific examples.

Start at clawbench.trajectory.has_dangerous_shell_pattern() and run the reproduction commands from the issue to confirm the current false negatives. Trace how quoted payloads are stripped, then ensure directly invoked bash, sh, and zsh -c wrappers are inspected without treating printed or otherwise non-executed text as dangerous; done means the three nested destructive commands are detected while the listed harmless examples remain ignored.