Quoting and Untrusted Text

Data must not become shell code

Pass prompt content through stdin or a JSON serializer, a tool that safely escapes quotes and newlines into valid JSON. Never join user text into a command and give it to eval or sh -c, because those tools interpret text as shell instructions. Put quotes around variable expansions such as "$file" so spaces and special characters stay data.

Use jq -n --arg prompt "$text" '{prompt:$prompt}' to encode newlines and quotes correctly. Use curl --data-binary @request.json for large structured bodies.

Danger: An LLM output is untrusted input. Never execute a suggested command automatically just because it came from a model.