Three custom handlers extend the list. check_xargs allows xargs only when the target command is itself in safe_commands; otherwise asks. check_shell_c parses bash -c/-lc '…' / sh -c '…' / zsh -c '…' and runs the raw security floor, then checks every command in the inner script. check_command_builtin handles command -v / -V and evaluates other invocations through the gate engine.