Unrestricted LLM-controlled bash execution with zero sandboxing

[consigcody94]

Found via code audit. basher.py:243-257. LLM output parsed for bash tags and executed directly as bash script. AGENTS.md in cwd enables persistent prompt injection for arbitrary RCE.