From 91c17a0bdc5e6fb3f10fd4ec9159f91a76d1876a Mon Sep 17 00:00:00 2001
From: "google-labs-jules[bot]"
 <161369871+google-labs-jules[bot]@users.noreply.github.com>
Date: Mon, 20 Jul 2026 21:37:34 +0000
Subject: [PATCH] chore(security): remove run_shell_command from CMO agent
 allowlist

Removed the highly privileged `run_shell_command` tool from the `galyarder-cmo` agent profile in both the root `agents/` directory and its duplicated shim files inside `integrations/`. This mitigates security risks for non-technical marketing personas and strictly enforces the Least Privilege principle.

Co-authored-by: GalihRensuke <126875499+GalihRensuke@users.noreply.github.com>
---
 agents/galyarder-cmo.md                   | 1 -
 integrations/claude-code/galyarder-cmo.md | 1 -
 integrations/codex/galyarder-cmo.md       | 1 -
 integrations/gemini/galyarder-cmo.md      | 1 -
 4 files changed, 4 deletions(-)

diff --git a/agents/galyarder-cmo.md b/agents/galyarder-cmo.md
index f528ee0b..94225270 100644
--- a/agents/galyarder-cmo.md
+++ b/agents/galyarder-cmo.md
@@ -5,7 +5,6 @@ tools:
   - read_file
   - grep_search
   - glob
-  - run_shell_command
   - write_file
   - replace
 ---
diff --git a/integrations/claude-code/galyarder-cmo.md b/integrations/claude-code/galyarder-cmo.md
index f528ee0b..94225270 100644
--- a/integrations/claude-code/galyarder-cmo.md
+++ b/integrations/claude-code/galyarder-cmo.md
@@ -5,7 +5,6 @@ tools:
   - read_file
   - grep_search
   - glob
-  - run_shell_command
   - write_file
   - replace
 ---
diff --git a/integrations/codex/galyarder-cmo.md b/integrations/codex/galyarder-cmo.md
index f528ee0b..94225270 100644
--- a/integrations/codex/galyarder-cmo.md
+++ b/integrations/codex/galyarder-cmo.md
@@ -5,7 +5,6 @@ tools:
   - read_file
   - grep_search
   - glob
-  - run_shell_command
   - write_file
   - replace
 ---
diff --git a/integrations/gemini/galyarder-cmo.md b/integrations/gemini/galyarder-cmo.md
index f528ee0b..94225270 100644
--- a/integrations/gemini/galyarder-cmo.md
+++ b/integrations/gemini/galyarder-cmo.md
@@ -5,7 +5,6 @@ tools:
   - read_file
   - grep_search
   - glob
-  - run_shell_command
   - write_file
   - replace
 ---