diff --git a/pipeline_service/agent_loop_v2.py b/pipeline_service/agent_loop_v2.py
index 02bf067..c0f2b90 100644
--- a/pipeline_service/agent_loop_v2.py
+++ b/pipeline_service/agent_loop_v2.py
@@ -173,7 +173,7 @@ class AgentExecutor:
                         tool_params = {}
 
                     # 需要确认的工具
-                    if self._needs_confirmation(tool_name):
+                    if self._needs_confirmation(tool_name, tool_params):
                         yield json.dumps({
                             "type": "confirm", "tool": tool_name, "params": tool_params,
                         }, ensure_ascii=False) + "\n"
@@ -233,7 +233,7 @@ class AgentExecutor:
                     tool_params = act.get("params", {})
 
                     # 需要确认的工具
-                    if self._needs_confirmation(tool_name):
+                    if self._needs_confirmation(tool_name, tool_params):
                         yield json.dumps({
                             "type": "confirm",
                             "tool": tool_name,
@@ -1201,11 +1201,24 @@ class AgentExecutor:
             pass
         return ""
 
-    def _needs_confirmation(self, tool_name: str) -> bool:
-        """检查工具是否需要用户确认"""
+    def _is_dangerous_command(self, cmd: str) -> bool:
+        """判断 shell 命令是否危险（run_command 只对危险命令要求确认）。"""
+        c = (cmd or "").strip().lower()
+        dangerous = (
+            "rm -rf", "rm -r", "sudo", "su ", "drop table", "drop database",
+            "truncate", "delete from", "mkfs", "dd if", ":(){", "shutdown",
+            "reboot", "kill -9", "chmod 777", "chown", "> /dev/",
+        )
+        return any(d in c for d in dangerous)
+
+    def _needs_confirmation(self, tool_name: str, params: dict = None) -> bool:
+        """检查工具是否需要用户确认。run_command 只对危险命令确认，普通命令自动执行。"""
         if self._tool_registry:
             tool = self._tool_registry.get(tool_name)
             if tool and tool.requires_confirmation:
+                if tool_name == "run_command":
+                    cmd = (params or {}).get("command", "")
+                    return self._is_dangerous_command(cmd)
                 return True
         return False