[hansmayer]

What if the agent were to create an alias to 'rm -rf' on my machine? I guess that would not have been blocked by your blacklist, right?

[Fosowl]

Well it can't use text editor, so it would have to use echo 'rm -rf' with a shell redirection to a file, which would be detected.