The AI-generated code interpolated attacker-controlled file paths directly into shell command strings, enabling command injection and arbitrary code execution.

-    sandbox_type: str = "subprocess"     working_dir: str = ""

@@ -288,7 +288,12 @@ def _resolve_model(self) -> str:     # Tool resolution     # ------------------------------------------------------------------     def _resolve_tools(self) -> List:-        """Resolve tool names to actual PraisonAI tool functions."""+        """Resolve tool names to actual PraisonAI tool functions.+        +        When a compute provider is attached, shell-based tools (execute_command,+        read_file, write_file, list_files) are bridged to run in the compute+        environment instead of on the host.+        """         raw_tools = self._cfg.get("tools", list(_DEFAULT_TOOLS))         tool_names = _translate_anthropic_tools(raw_tools) @@ -299,12 +304,18 @@ def _resolve_tools(self) -> List:          # Import tools lazily         tools = []+        compute_bridged_tools = {"execute_command", "read_file", "write_file", "list_files"}+                 for name in resolved_names:             try:                 from praisonaiagents import tools as tool_module                 func = getattr(tool_module, name, None)                 if func is not None:-                    tools.append(func)+                    # Bridge shell-based tools to compute when available+                    if self._compute and name in compute_bridged_tools:+                        tools.append(self._create_compute_bridge_tool(name, func))+                    else:+                        tools.append(func)                 else:                     logger.warning("[local_managed] tool not found: %s", name)             except Exception as e:@@ -327,6 +338,119 @@ def _resolve_tools(self) -> List:          return tools +    def _create_compute_bridge_tool(self, tool_name: str, original_func: Callable) -> Callable:+        """Create a compute-bridged version of a tool.+        +        Wraps the original tool function to execute commands in the compute+        environment instead of on the host.+        """+        import inspect+        import asyncio+        +        def compute_bridged_tool(*args, **kwargs):+            """Compute-bridged tool wrapper."""+            # Auto-provision compute if needed+            if self._compute_instance_id is None:+                try:+                    loop = asyncio.get_event_loop()+                    loop.run_until_complete(self.provision_compute())+                except RuntimeError:+                    asyncio.run(self.provision_compute())+            +            if tool_name == "execute_command":+                # For execute_command, directly route to compute+                command = args[0] if args else kwargs.get("command", "")+                if not command:+                    return "Error: No command specified"+                +                try:+                    try:+                        loop = asyncio.get_event_loop()+                        result = loop.run_until_complete(+                            self._compute.execute(self._compute_instance_id, command)+                        )+                    except RuntimeError:+                        result = asyncio.run(+                            self._compute.execute(self._compute_instance_id, command)+                        )+                    +                    # Format result similar to local execute_command+                    if result.get("exit_code", 0) == 0:+                        return result.get("stdout", "")

@@ -353,6 +353,214 @@ def test_packages_in_config(self):

+            mock_run.return_value = None+            agent._install_packages()  # Should not raise+            mock_run.assert_called_once()++    def test_install_packages_with_compute_uses_sandbox(self):+        """Test that package installation with compute provider uses sandbox."""+        from unittest.mock import AsyncMock, patch+        from praisonai.integrations.managed_local import LocalManagedAgent, LocalManagedConfig+        +        cfg = LocalManagedConfig(packages={"pip": ["requests"]})+        agent = LocalManagedAgent(config=cfg, compute="local")+        +        # Mock the compute execution+        with patch.object(agent, 'provision_compute') as mock_provision, \+             patch.object(agent._compute, 'execute') as mock_execute, \+             patch('asyncio.run') as mock_asyncio_run, \+             patch('asyncio.get_event_loop') as mock_get_loop:+            +            mock_provision.return_value = None+            mock_execute.return_value = {"exit_code": 0, "stdout": "installed"}+            agent._compute_instance_id = "test_instance"+            mock_asyncio_run.return_value = {"exit_code": 0, "stdout": "installed"}+            +            agent._install_packages()+            +            # Verify subprocess.run was NOT called (no host installation)+            with patch('praisonai.integrations.managed_local.subprocess.run') as mock_run:+                agent._install_packages()+                mock_run.assert_not_called()++    def test_no_packages_no_error(self):+        """Test that agents without packages work normally."""+        from praisonai.integrations.managed_local import LocalManagedAgent+        agent = LocalManagedAgent()+        agent._install_packages()  # Should not raise

+# ---------------------------------------------------------------------------

+    but no compute provider is specified, creating a security risk where packages+    would be installed on the host system.

+ # --------------------------------------------------------------------------- # ManagedConfig — Anthropic-specific configuration dataclass # Lives in the Wrapper (not Core SDK) because its fields map directly to

             content = args[1] if len(args) > 1 else kwargs.get("content", "")             if not filepath:                 return "Error: No filepath specified"-