It can, if it’s passed through to tools without the llm meddling, but the problem is that there is typically a tool for arbitrary shell commands, and unless there’s a mechanism to dry run these, there’s no way to handle it reliably.