Security: developer shell tool executes LLM-supplied commands without sandbox (arbitrary command execution)

Describe the bug

The developer extension's shell tool (crates/goose/src/agents/platform_extensions/developer/shell.rs) passes the LLM-supplied command string verbatim to the host shell — cmd /C on Windows, <shell> -c on POSIX — with no allowlist, sandbox, or content validation. The only pre-execution checks are an empty-string guard and a Windows cmd newline guard (shell.rs:388-400). The permission gate's default mode GooseMode::Auto returns Allow unconditionally for every tool call (permission_inspector.rs:159-161), and an unset GOOSE_MODE falls back to Auto via unwrap_or_default() (agent.rs:396). Because the developer extension is default_enabled with unprefixed_tools, the shell tool is always registered. As a result, on a default install, content an attacker controls (a web page, README, git repository, MCP output, or file) can induce the model to call the shell tool and execute arbitrary commands on the host with no confirmation — prompt-injection-driven remote code execution.

To Reproduce

1. Install goose 1.52.0 and leave GOOSE_MODE unset (the out-of-the-box default).
2. Create a workspace containing an attacker-controlled instruction file that asks the agent to run a shell command (for example one that writes a marker file via a > redirection).
3. Run goose run -i <file> --no-session.
4. Observe that the shell command executes on the host with no approval prompt and the marker file is written.

Expected behavior

LLM-issued shell commands should not execute unsandboxed and unconfirmed by default. A safe default would require explicit approval (e.g. Approve/SmartApprove) and/or sandbox the shell tool, and should not fall back to auto-approval when GOOSE_MODE is unset.

Technical advisory

n/a (CLI, no screenshots). Full technical write-up and the English proof-of-concept are published at:

• Advisory: https://github.com/ybyu-ieu/agent-security-advisories/blob/main/goose/goose-1.52.0-shell-tool-arbitrary-command-execution.md
• PoC: https://github.com/ybyu-ieu/agent-security-advisories/blob/main/goose/goose-1.52.0-shell-tool-arbitrary-command-execution-poc.py

Please provide the following information

• OS & Arch: Windows 11 x64 (reproducible on Linux/macOS — POSIX path uses <shell> -c)
• Interface: CLI
• Version: v1.52.0
• Extensions enabled: developer (default)
• Provider & Model: any (proof-of-concept uses a mock LLM)

Additional context

This is a distinct code path from CVE-2026-72718 (the goose review git command) and CVE-2026-85623 (recipe extensions). A CVE ID has been requested through VulnCheck and is currently under review. Suggested remediation: default the permission mode to Approve/SmartApprove (fail closed), remove the unwrap_or_default() fallback to Auto, and sandbox or allowlist the shell tool.

Do not begin implementation until the issue reaches Ready on the Goose Issues board.