From e9024b7c190a66fcc14d5531c07ac1c66ae223f9 Mon Sep 17 00:00:00 2001
From: dorien-koelemeijer
 <62866702+dorien-koelemeijer@users.noreply.github.com>
Date: Tue, 27 Jan 2026 12:25:11 +0700
Subject: [PATCH] Logging uplift for model training purposes (command injection
 model) [Small change] (#6330)

---
 crates/goose/src/agents/tool_execution.rs |  3 ++-
 crates/goose/src/security/mod.rs          | 11 ++++++++---
 2 files changed, 10 insertions(+), 4 deletions(-)

diff --git a/crates/goose/src/agents/tool_execution.rs b/crates/goose/src/agents/tool_execution.rs
index 14ab3ec1..5ffd6eb7 100644
--- a/crates/goose/src/agents/tool_execution.rs
+++ b/crates/goose/src/agents/tool_execution.rs
@@ -91,7 +91,8 @@ impl Agent {
                                 counter.goose.prompt_injection_user_decisions = 1,
                                 decision = ?confirmation.permission,
                                 finding_id = %finding_id,
-                                "User security decision"
+                                tool_request_id = %request.id,
+                                "Prompt injection detection: user decision on command injection finding"
                             );
                         }
 
diff --git a/crates/goose/src/security/mod.rs b/crates/goose/src/security/mod.rs
index e0326835..780a0a45 100644
--- a/crates/goose/src/security/mod.rs
+++ b/crates/goose/src/security/mod.rs
@@ -114,20 +114,25 @@ impl SecurityManager {
                     let above_threshold = analysis_result.confidence > config_threshold;
                     let finding_id = format!("SEC-{}", Uuid::new_v4().simple());
 
+                    let tool_call_json =
+                        serde_json::to_string(&tool_call).unwrap_or_else(|_| "{}".to_string());
+
                     tracing::warn!(
                         counter.goose.prompt_injection_finding = 1,
+                        threat_type = "command_injection",
                         above_threshold = above_threshold,
                         tool_name = %tool_call.name,
                         tool_request_id = %tool_request.id,
+                        tool_call_json = %tool_call_json,
                         confidence = analysis_result.confidence,
                         explanation = %sanitized_explanation,
                         finding_id = %finding_id,
                         threshold = config_threshold,
                         "{}",
                         if above_threshold {
-                            "Current tool call flagged as malicious after security analysis (above threshold)"
+                            "Prompt injection detection: Current tool call flagged as malicious after security analysis (above threshold)"
                         } else {
-                            "Security finding below threshold - logged but not blocking execution"
+                            "Prompt injection detection: Security finding below threshold (logged but not blocking execution)"
                         }
                     );
                     if above_threshold {
@@ -155,7 +160,7 @@ impl SecurityManager {
         tracing::info!(
             counter.goose.prompt_injection_analysis_performed = 1,
             security_issues_found = results.len(),
-            "Security analysis complete"
+            "Prompt injection detection: Security analysis complete"
         );
         Ok(results)
     }