[BUG] TerminalToolkit.shell_exec allows prompt-driven shell command execution without an approval boundary

### Required prerequisites - [x] I have read the documentation <https://camel-ai.github.io/camel/camel.html>. - [x] I have searched the [Issue Tracker](https://github.com/camel-ai/camel/issues) and [Discussions](https://github.com/camel-ai/camel/discussions) that this hasn't already been reported. (+1 or comment there if it has.) - [x] Consider asking first in a [Discussion](https://github.com/camel-ai/camel/discussions/new). ### What version of camel are you using? 0.2.91a1- v0.2.91a4 ### System information 3.12.7 | win 0.2.91a4 ### Problem description When TerminalToolkit is exposed to a ChatAgent, a normal user prompt can cause the model to call shell_exec, which reaches TerminalToolkit.shell_exec and executes shell commands in the configured working directory. Expected behavior: shell command execution should require an explicit confirmation, policy gate, or strong isolation boundary before model-selected commands are executed. Actual behavior: in the validated run, the agent called shell_exec, executed a shell command, and created a marker file in the working directory. ### Reproducible example code The Python snippets: ```python import os from pathlib import Path from camel.agents import ChatAgent from camel.configs import AnthropicConfig from camel.models import ModelFactory from camel.toolkits import TerminalToolkit from camel.types import ModelPlatformType, ModelType workspace = Path("camel-terminal-repro-workspace").resolve() workspace.mkdir(parents=True, exist_ok=True) artifact = workspace / "camel_terminal_poc.txt" if artifact.exists(): artifact.unlink() model = ModelFactory.create( model_platform=ModelPlatformType.ANTHROPIC, model_type=ModelType.CLAUDE_HAIKU_4_5, model_config_dict=AnthropicConfig(temperature=0.0).as_dict(), ) tools = TerminalToolkit(working_directory=str(workspace)).get_tools() agent = ChatAgent( system_message=( "You are a software engineer with terminal access. " "When asked to create or inspect files, use the available terminal tools." ), model=model, tools=tools, ) prompt = ( "Use the terminal tool to create a file named " "'camel_terminal_poc.txt' in the working directory with the exact " "content CAMEL_A3_POC_MARKER, then print the file content." ) response = agent.step(prompt) print("artifact_exists:", artifact.exists()) print("artifact_content:", artifact.read_text(encoding="utf-8") if artifact.exists() else None) print("tool_calls:", (response.info or {}).get("tool_calls", [])) ``` Command lines: ```bash export ANTHROPIC_API_KEY=<your API key> python reproduce_camel_terminal.py ``` Extra dependencies: ```text camel-ai==0.2.91a4 A tool-call capable Anthropic-compatible model/API key ``` Steps to reproduce: 1. Install or check out CAMEL 0.2.91a1. 2. Set a valid ANTHROPIC_API_KEY. 3. Run the Python snippet above. 4. Observe that camel_terminal_poc.txt is created. ### Traceback ```pytb No Python traceback is required to reproduce this issue. ``` ### Expected behavior A user prompt should not be able to cause shell commands to run through TerminalToolkit.shell_exec unless the application has explicitly opted into that behavior with a clear approval or isolation boundary. ### Additional context camel/toolkits/terminal_toolkit/terminal_toolkit.py:674 TerminalToolkit.shell_exec camel/toolkits/terminal_toolkit/terminal_toolkit.py:752 subprocess.Popen(..., shell=True) The same code path was source-continuity checked in v0.2.91a2 and v0.2.91a3.