diff --git a/pkg/tools/filesystem_test.go b/pkg/tools/filesystem_test.go
index d0c51b28c..cd95c46e5 100644
--- a/pkg/tools/filesystem_test.go
+++ b/pkg/tools/filesystem_test.go
@@ -385,9 +385,10 @@ func TestFilesystemTool_ReadFile_RejectsSymlinkEscape(t *testing.T) {
 		t.Skipf("symlink not supported in this environment: %v", err)
 	}
 
-	tool := NewReadFileTool(workspace, true)
+	tool := NewReadFileToolWithPolicy(workspace, true, PathPolicyOpts{PathMode: security.ModeBlock})
+	relPath, _ := filepath.Rel(workspace, link)
 	result := tool.Execute(context.Background(), map[string]interface{}{
-		"path": link,
+		"path": relPath,
 	})
 
 	if !result.IsError {
diff --git a/pkg/tools/shell.go b/pkg/tools/shell.go
index 847faf303..e3b406549 100644
--- a/pkg/tools/shell.go
+++ b/pkg/tools/shell.go
@@ -65,6 +65,13 @@ var defaultDenyPatterns = []*regexp.Regexp{
 	regexp.MustCompile(`\bpkill\b`),
 	regexp.MustCompile(`\bkillall\b`),
 	regexp.MustCompile(`\bkill\s+-[9]\b`),
+	regexp.MustCompile(`\bcurl\b.*\s+(-d|--data|--data-raw|--data-binary|-F|--form|-T|--upload-file)\b`),
+	regexp.MustCompile(`\bwget\b.*\s+(--post-data|--post-file)\b`),
+	regexp.MustCompile(`\bnc\b\s+\S+\s+\d+`),
+	regexp.MustCompile(`\bncat\b\s+\S+\s+\d+`),
+	regexp.MustCompile(`base64\b.*\|\s*(sh|bash|zsh)\b`),
+	regexp.MustCompile(`\b(bash|sh|zsh)\s+-i\s+[>&]`),
+	regexp.MustCompile(`/dev/tcp/`),
 	regexp.MustCompile(`\bcurl\b.*\|\s*(sh|bash)`),
 	regexp.MustCompile(`\bwget\b.*\|\s*(sh|bash)`),
 	regexp.MustCompile(`\bnpm\s+install\s+-g\b`),
diff --git a/pkg/tools/shell_test.go b/pkg/tools/shell_test.go
index 946a7ed94..c393ca05f 100644
--- a/pkg/tools/shell_test.go
+++ b/pkg/tools/shell_test.go
@@ -215,7 +215,7 @@ func TestShellTool_RestrictToWorkspace(t *testing.T) {
 // TestShellTool_DataExfiltrationBlocked verifies data exfiltration patterns are blocked
 // when exec_guard mode is "block".
 func TestShellTool_DataExfiltrationBlocked(t *testing.T) {
-	tool := NewExecToolWithConfig("", false, ExecToolConfig{ExecGuardMode: "block"})
+	tool := NewExecToolWithConfig("", false, ExecToolConfig{ExecGuardMode: security.ModeBlock})
 	ctx := context.Background()
 
 	dangerousCmds := []string{