4-step workflowcommand-validation security-pipeline shell validators agent-security guided-flow Agent QA & Security

Build a Command Security Pipeline for Your Agent

Replace scattered if-else safety checks with a layered validator pipeline: single-purpose checks, an allow/ask/deny/passthrough contract, and severity-aware ordering.

Run this as a guided flow on Flows — verify gates and recovery prompts included →

Flows@flows12d ago

0 runs0 forks0

Chain

Inputs

Step 1

flow-command-security-pipeline-agent-1-define-the-contract-and-pipeline-skeleton

Step 2

flow-command-security-pipeline-agent-2-implement-early-validators-and-input-hygi

Step 3

flow-command-security-pipeline-agent-3-build-the-main-validator-chain-and-hard-p

Step 4

flow-command-security-pipeline-agent-4-order-by-severity-and-regression-test-wit

Final output

Workflow inputs

No inputs required — hit Run to stream each step in order.

Each step streams from its model and feeds the next. BYOK — you pay your provider directly. Add a key in Settings if a step needs one.

Step 1 · A uniform result type is what makes 20 checks composable.

flow-command-security-pipeline-agent-1-define-the-contract-and-pipeline-skeleton

Claude Sonnet 4.6→ {{step_1}}

Awaiting upstream steps…

Step 2 · Cheap checks first: catch garbage and fast-path the common safe cases.

flow-command-security-pipeline-agent-2-implement-early-validators-and-input-hygi

Claude Sonnet 4.6→ {{step_2}}

Awaiting upstream steps…

Step 3 · One attack class per validator, plus constraints nothing can override.

flow-command-security-pipeline-agent-3-build-the-main-validator-chain-and-hard-p

Claude Sonnet 4.6→ {{step_3}}

Awaiting upstream steps…

Step 4 · The most severe finding must win, and stay winning.

flow-command-security-pipeline-agent-4-order-by-severity-and-regression-test-wit

Claude Sonnet 4.6→ {{step_4}}

Awaiting upstream steps…

About this workflow

Replace scattered if-else safety checks with a layered validator pipeline: single-purpose checks, an allow/ask/deny/passthrough contract, and severity-aware ordering.

What happens when you run it

1
A uniform result type is what makes 20 checks composable.
Runs flow-command-security-pipeline-agent-1-define-the-contract-and-pipeline-skeleton on Claude Sonnet 4.6
2
Cheap checks first: catch garbage and fast-path the common safe cases.
Runs flow-command-security-pipeline-agent-2-implement-early-validators-and-input-hygi on Claude Sonnet 4.6
3
One attack class per validator, plus constraints nothing can override.
Runs flow-command-security-pipeline-agent-3-build-the-main-validator-chain-and-hard-p on Claude Sonnet 4.6
4
The most severe finding must win, and stay winning.
Runs flow-command-security-pipeline-agent-4-order-by-severity-and-regression-test-wit on Claude Sonnet 4.6

Best for

•Recurring tasks you currently copy-paste between tools.
•When a single prompt isn't enough — you need a chain where output(n) feeds prompt(n+1).
•Fork and adapt if your inputs differ materially from the author's use case.

Models used

Claude Sonnet 4.6