Quoting and Untrusted Text

Data must not become shell code

Whenever prompt content includes text from an external source - a user's typed input, a file's contents, a retrieved document - that text needs to travel through a channel that treats it purely as data, never as something that could be interpreted as commands. Pass it through stdin, or run it through a JSON serializer - a tool that correctly escapes quotes, newlines, and other special characters into valid JSON syntax automatically. Never directly concatenate raw user text into a shell command string and then hand that string to eval or sh -c, because both of those specifically interpret whatever text they receive as shell instructions to execute - a classic and dangerous shell-injection vulnerability if the text contains something like ; rm -rf ~. Even simpler variable expansions deserve care: always quote them, as in "$file", so that spaces or other special characters inside the value stay treated as literal data rather than being reinterpreted by the shell.

$ text="Summarize this: it's \"critical\""
$ jq -n --arg prompt "$text" '{prompt:$prompt}' > request.json
$ cat request.json
{"prompt":"Summarize this: it's \"critical\""}
$ curl -s http://127.0.0.1:11434/api/generate --data-binary @request.json ...

jq -n --arg prompt "$text" '{prompt:$prompt}' is doing exactly this kind of safe encoding: it takes the raw shell variable and correctly escapes every quote and newline it contains into valid JSON, something manual string concatenation gets wrong the moment the input contains a stray quote character of its own. For larger structured request bodies, curl --data-binary @request.json sends the contents of a file directly as the request body, sidestepping shell quoting issues entirely for the bulk of the payload.

Danger: Treat every piece of LLM-generated output as untrusted input too, not just text coming into the model. Never automatically execute a command the model suggests just because it came out of an AI - a poisoned prompt, or simply an overconfident wrong guess from the model, could suggest something destructive, and "the model said so" is not a safety check.