Claude Code agents interpolate tool outputs into shell commands. Without a validation layer, that's a real attack surface.