I just set a hard permission deny on any command matching `\bpgrep\b.
\s+(-\wf|--full)\s+"[^\]"]+"` with denial reason "It looks like you are trying to identify a running process via a command like `pgrep -f "my-command --my-args"`. This will match the spawned shell process itself, which is likely unintended. Use instead e.g. `pgrep -f "[m]y-command --my-args"`. If this was a false positive, either embed your code in a temp script, or (preferred) get and confirm the target pid(s) by calling pgrep directly (this auto-deny only fires if characters precede the pgrep call) and then run your subsequent code on the pid(s)."
Haven't had issues since then.