From 5b15593e0a2dd6c47dae4b5c6a47d73324554eb3 Mon Sep 17 00:00:00 2001
From: dorien-koelemeijer
 <62866702+dorien-koelemeijer@users.noreply.github.com>
Date: Tue, 10 Feb 2026 05:09:12 +0700
Subject: [PATCH] Fix: Only send command content to command injection
 classifier (excluding part of tool call dict) (#7082)

---
 crates/goose/src/security/scanner.rs | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/crates/goose/src/security/scanner.rs b/crates/goose/src/security/scanner.rs
index dca32e1e..1e6b4607 100644
--- a/crates/goose/src/security/scanner.rs
+++ b/crates/goose/src/security/scanner.rs
@@ -350,6 +350,15 @@ impl PromptInjectionScanner {
     }
 
     fn extract_tool_content(&self, tool_call: &CallToolRequestParams) -> String {
+        if let Some(cmd_str) = tool_call
+            .arguments
+            .as_ref()
+            .and_then(|args| args.get("command"))
+            .and_then(|v| v.as_str())
+        {
+            return cmd_str.to_string();
+        }
+
         let mut s = format!("Tool: {}", tool_call.name);
         if let Some(args) = &tool_call.arguments {
             if let Ok(json) = serde_json::to_string(args) {