Semantic Dissection of Commands

A blacklist of keywords fails to cope with the combinatorial explosion of Shell commands: the ban is bypassed via pipelines, nested shells, variable expansion ($(echo rm) -rf /).

Semantic dissection is needed: understanding the types of arguments for each command and the rules for their consumption, recognizing patterns like “a harmless flag consumes the next argument, hiding a dangerous payload” (find -exec rm; curl -o /etc/crontab).

This is an advanced implementation of the “limiting” function: understanding, not pattern matching.