diff --git a/src/cai/tools/reconnaissance/crypto_tools.py b/src/cai/tools/reconnaissance/crypto_tools.py
index f9bea5f9..d7e6f63b 100644
--- a/src/cai/tools/reconnaissance/crypto_tools.py
+++ b/src/cai/tools/reconnaissance/crypto_tools.py
@@ -2,6 +2,7 @@
 Here are crypto tools
 """
 
+import shlex
 from cai.tools.common import run_command
 from cai.sdk.agents import function_tool
 
@@ -25,7 +26,7 @@ def strings_command(file_path: str, ctf=None) -> str:
     #     Returns:
             str: The output of running the strings command
     """
-    command = f"strings {file_path}"
+    command = f"strings {shlex.quote(file_path)}"
     return run_command(command, ctf=ctf)
 
 
@@ -41,7 +42,7 @@ def decode64(input_data: str, ctf=None) -> str:
     Returns:
         str: The decoded string
     """
-    command = f"base64 --decode {input_data}"
+    command = f"base64 --decode {shlex.quote(input_data)}"
     return run_command(command, ctf=ctf)
 
 
diff --git a/src/cai/tools/reconnaissance/curl.py b/src/cai/tools/reconnaissance/curl.py
index 57474538..7fe65c35 100644
--- a/src/cai/tools/reconnaissance/curl.py
+++ b/src/cai/tools/reconnaissance/curl.py
@@ -2,6 +2,7 @@
 Here are the curl tools.
 """
 
+import shlex
 from cai.tools.common import run_command  # pylint: disable=import-error
 from cai.sdk.agents import function_tool
 
@@ -18,7 +19,7 @@ def curl(args: str = "", target: str = "", ctf=None) -> str:
     Returns:
         str: The output of running the curl command
     """
-    command = f"curl {args} {target}"
+    command = f"curl {args} {shlex.quote(target)}"
     return run_command(command, ctf=ctf)
 
 
diff --git a/src/cai/tools/reconnaissance/filesystem.py b/src/cai/tools/reconnaissance/filesystem.py
index 7dfe7149..17ff2e04 100644
--- a/src/cai/tools/reconnaissance/filesystem.py
+++ b/src/cai/tools/reconnaissance/filesystem.py
@@ -2,6 +2,7 @@
 Here are the CLI tools for executing commands.
 """
 
+import shlex
 from cai.tools.common import run_command  # pylint: disable=E0401
 from cai.sdk.agents import function_tool
 
@@ -18,7 +19,7 @@ def list_dir(path: str, args: str = "", ctf=None) -> str:
     Returns:
         str: The output of running the ls command
     """
-    command = f"ls {path} {args}"
+    command = f"ls {shlex.quote(path)} {args}"
     return run_command(command, ctf=ctf)
 
 
@@ -34,7 +35,7 @@ def cat_file(file_path: str, args: str = "", ctf=None) -> str:
     Returns:
         str: The output of running the cat command
     """
-    command = f"cat {args} {file_path} "
+    command = f"cat {args} {shlex.quote(file_path)}"
     return run_command(command, ctf=ctf)
 
 
@@ -65,7 +66,7 @@ def find_file(file_path: str, args: str = "", ctf=None) -> str:
     """
     Find a file in the filesystem.
     """
-    command = f"find {file_path} {args}"
+    command = f"find {shlex.quote(file_path)} {args}"
     return run_command(command, ctf=ctf)
 
 
diff --git a/src/cai/tools/reconnaissance/nmap.py b/src/cai/tools/reconnaissance/nmap.py
index 12707b62..01412ba4 100644
--- a/src/cai/tools/reconnaissance/nmap.py
+++ b/src/cai/tools/reconnaissance/nmap.py
@@ -2,6 +2,7 @@
 Here are the nmap tools.
 """
 
+import shlex
 from cai.tools.common import run_command  # pylint: disable=E0401
 from cai.sdk.agents import function_tool
 
@@ -18,7 +19,7 @@ def nmap(args: str, target: str, ctf=None) -> str:
     Returns:
         str: The output of running the nmap command
     """
-    command = f"nmap {args} {target}"
+    command = f"nmap {args} {shlex.quote(target)}"
     return run_command(command, ctf=ctf, stream=True)
 
 
diff --git a/src/cai/tools/reconnaissance/wget.py b/src/cai/tools/reconnaissance/wget.py
index a90c09dc..989d5587 100644
--- a/src/cai/tools/reconnaissance/wget.py
+++ b/src/cai/tools/reconnaissance/wget.py
@@ -4,6 +4,7 @@
 Wget tool
 """
 
+import shlex
 from cai.tools.common import run_command  # pylint: disable=import-error
 from cai.sdk.agents import function_tool
 
@@ -19,7 +20,7 @@ def wget(url: str, args: str = "", ctf=None) -> str:
     Returns:
         str: The output of running the wget command
     """
-    command = f"wget {args} {url}"
+    command = f"wget {args} {shlex.quote(url)}"
     return run_command(command, ctf=ctf)