rules-cohere

Generated code uses the deprecated `cohere.generate_code` API with `safety_filters=False`. This bypasses critical security guardrails. Migrate to `cohere.generate_safe_code()` or ensure `safety_filters=True` is explicitly set and justified. This configuration is highly discouraged for production environments.

Generated code configures `cohere.CodeGenerationConfig` to `allow_filesystem_write=True`. This grants the AI model broad write access to the filesystem, posing a significant risk for data corruption or malicious file creation. Restrict filesystem access unless absolutely necessary and implement strict sandboxing. Default to `allow_filesystem_write=False`.

Generated Python code uses `subprocess.run` with `shell=True` and potentially user-controlled input (e.g., f-strings, variables). This is a critical command injection vulnerability. Always sanitize inputs and avoid `shell=True` for untrusted commands. Prefer `shell=False` and pass commands as a list of arguments.

Generated Python code constructs file paths using string concatenation (e.g., f-strings) instead of `os.path.join`. This is a common source of path traversal vulnerabilities. Always use `os.path.join()` to safely construct paths, especially when dealing with user-controlled input.

Generated Python code uses wildcard imports (`from module import *`). While not strictly a vulnerability, this is discouraged by the Cohere recommended style guide for generated code (aligning with PEP 8). It can lead to namespace pollution, make code harder to read, and obscure the origin of functions, potentially hiding malicious imports. Prefer explicit imports (e.g., `from module import func1, func2`).

Generated code appears to embed a Cohere API key directly. This is a severe security risk. API keys should be loaded from environment variables, secure vaults, or configuration management, never hardcoded. Remove the hardcoded key immediately.