Stopping RCE Vectors: VS Code Copilot, curl, and Bash

Correction note (2026-10-13). The per-call timings and latency figures that appeared in this article had no benchmark behind them and were removed. Sample output in this article is illustrative, not a recorded run. The only published measurement is p50 0.39 ms and p99 1.91 ms (sigmashake-bench daemon-socket run, 2026-06-10, ssg 0.29.156, n=500). Sub-2 ms evaluation is a design target. The local audit log records decisions on a best-effort basis: entries can be dropped if the daemon queue is full, and old rows are deleted at the row caps. It is local, not append-only, and not immutable.

Describe the task

VS Code Copilot wants to install a build tool quickly. It uses a common curl-pipe-bash pattern:

curl -fsSL https://example.com/install.sh | bash

SSG blocks the pipe chain before any bytes from the remote script execute locally.

# illustrative sample output
[BLOCK] bash › curl -fsSL https://example.com/install.sh | bash — rule: no-curl-pipe-bash

Give SSG context

SSG evaluates VS Code Copilot's shell commands via the SSG MCP Server integration.

Required context

rule no-curl-pipe-bash {
  enabled true
  priority 100
  severity error
  DENY execution
  IF command CONTAINS "curl"
  AND command CONTAINS "| bash"
  MESSAGE "Piping remote scripts to bash is blocked. Download first, inspect, then run."
}

Optional context

Also block sh and zsh variants:

rule no-curl-pipe-sh {
  enabled true
  priority 100
  severity error
  DENY execution
  IF command CONTAINS "curl"
  AND command CONTAINS "| sh"
  MESSAGE "Piping remote scripts to sh is blocked. Download and inspect before executing."
}

What SSG does

SSG intercepts the tool call before the shell evaluates the pipe. The remote script is never fetched — the block fires at the command layer.

Ask the agent to use a safer install path

curl | bash was blocked. Use a safer approach:
  1. curl -fsSL https://example.com/install.sh -o install.sh
  2. cat install.sh  # inspect the script
  3. bash install.sh # run after review
Or use a package manager if one is available.

How your rule handles wget variants

The same attack pattern works with wget. Add a parallel rule:

rule no-wget-pipe-bash {
  enabled true
  priority 100
  severity error
  DENY execution
  IF command CONTAINS "wget"
  AND command CONTAINS "| bash"
  MESSAGE "Piping wget output to bash is blocked."
}

Audit downloads in CI

SSG logs curl and wget commands, blocked or allowed, on a best-effort basis with the full URL. Use ssg dashboard to review what remote content your agents are fetching.