SafeShell | Secure Command Execution & Linux Sandboxing (https://github.com/HamzaGhebriche/SafeShell)
SafeShell is an open-source Python security tool I developed to inspect potentially dangerous shell commands, enforce execution policies, and run permitted commands within a restricted Linux sandbox.
The project focuses on improving command execution safety in development environments, automation workflows, and security-sensitive applications.
🔐 Key Features
1. Command Security Analysis
Inspects shell commands before execution.
Identifies potentially dangerous command patterns.
Generates structured findings and risk information.
Supports deterministic command analysis without executing the submitted command.
2. Secure Linux Sandboxing
Uses Bubblewrap and Linux security controls to restrict command execution.
Implements Linux namespaces and seccomp-based restrictions.
Reduces access to host resources through controlled filesystem and runtime configurations.
Refuses protected execution when required security mechanisms are unavailable.
3. Security Policies & Access Control
Enforces configurable offline execution policies.
Supports explicit authorization for permitted operations.
Prevents approvals from overriding hard security restrictions.
Provides structured execution decisions and status information.
4. Security Automation & Auditing
Offers a Python command-line interface.
Supports JSON output for integration with automation workflows.
Records local execution metadata for review.
Provides timeout and output-size controls.
5. Cross-Platform Development
Supports command inspection and policy management on Linux, Windows, and macOS.
Provides protected execution on supported Linux environments.
Includes automated validation through CI pipelines.
Technologies: Python, Linux, Bubblewrap, seccomp, Linux Namespaces, Bash, GitHub Actions, JSON, Security Automation.
My Role: Independent Developer & Security Engineer.
Project Type: Open-source security tool.
Current Status: Experimental alpha release (v0.1.0-alpha).
SafeShell has undergone automated testing but has not received an independent security audit. It is not intended to serve as a production-grade security boundary.
0
27
2 Peer-Reviewed Publications — ML for Biomedical Classification
Co-authored two peer-reviewed papers on applied
machine learning and deep learning in clinical and biological contexts,
working with CNRS, CEA, and Université Côte d'Azur.
Paper 1 — Bioinformatics:
Introduced PD-CR, a novel primal-dual classification
method outperforming SVM, Random Forests, and PLS-DA
on cancer metabolomics datasets (lung & brain tumors).
Real clinical data from university hospitals of Nice
and Montpellier.
Paper 2 — IEEE/ACM Transactions on Computational Biology and Bioinformatics:
Non-invasive live cell cycle monitoring using a
supervised autoencoder on Quantitative Phase Imaging
data. Achieved 98.6% classification accuracy on
80,000+ cells.
Both projects used real clinical datasets.
No simulations.
0
70
Collaborative project built at Kaggle Week 26 GenAI Hackathon, contributed the core AI engineering layers of a Business Law RAG Assistant that answers legal document queries with source citations and live faithfulness verification.
My contributions: built the hybrid FAISS + BM25 retrieval pipeline for accurate document search; designed the multi-agent orchestration system coordinating retrieval, generation, and verification agents; implemented the faithfulness verification layer to evaluate and score LLM output quality; integrated an MCP tool server enabling live web search as a fallback; and built the analytics dashboard tracking query performance and retrieval metrics.
Built as part of a 4-person team, my work covered the RAG pipeline, agentic architecture, and evaluation infrastructure.
0
48
