Agent skill · security · jeremylongshore
detecting-command-injection-patterns
Scan a source tree for command-injection vulnerable patterns: shell=True calls in Python subprocess, os.system / os.popen with interpolated strings, Node child_process.exec with template literals, Ruby backticks / Kernel#system / Kernel#exec with interpolation, Go exec.Command with shell wrapping, PHP system / passthru / shell_exec / backticks with $-interpolation, Java Runtime.exec with concatenated args. Use when: pre-commit gate on code that calls out to shell utilities, audit of file-processing / archive-handling / image-conversion code, post-bug-report investigation for "we shell out to a tool." Threshold: any shell-invocation API called with a string that contains a variable interpolation, OR shell=True with anything other than a fixed literal. Trigger with: "scan command injection", "shell=True audit", "find exec calls", "check os.system".
Why this skill is useful
Adds a script for scanning command injection vulnerabilities across multiple programming languages, which is not commonly found in public documentation.
What it needs
Requires python3 installed locally. About 3k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Detecting Command Injection Patterns Overview Command injection (CWE-78, OWASP A03:2021) shows up wherever an application shells out to a binary. Image conversion (convert), archive extraction (tar, unzip), video processing (ffmpeg), DNS lookup (dig), and "we just need to call this CLI tool once" are the common origins. The vulnerability shape is universal: a string is built including user input, then handed to a shell interpreter. The shell parses the string with normal shell semantics — including ;, , &, $(), backticks. Any of those in the user-controlled portion becomes shell-executable. When the skill produces findings Finding Severity Threshold Affected control --- --- --- --- Python subprocess.run(..., shell=True) with interpolation CRITICAL f-string / concat / format argument with shell=True CWE-78 Python os.system(...) with interpolation CRITICAL non-literal argument CWE-78 Python os.popen(...) with interpolation CRITICAL non-literal argument CWE-78 Node childprocess.exec(...) with template literal CRITICAL ${...} in the command string CWE-78 Node childprocess.execSync(...) with template CRITICAL same CWE-78 Ruby backticks with interpolation CRITICAL cmd #{var} CWE-78 Ruby Kernel#system(string) with interpolation CRITICAL system("cmd #{var}") CWE-78 Go exec.Command("sh", "-c", ...) with interpolation HIGH shell wrapper with var CWE-78 PHP system / exec / passthru / shellexec with $-interp CRITICAL system("cmd $var") CWE-78 Java Runtime.exec(String) with concat HIGH single-string form (vs array) with var CWE-78 Prerequisites Python 3.9+ Target source tree on local filesystem Instructions Step 1 — Run the scanner Options: Step 2 — Interpret findings CRITICAL = direct user-input → shell construction. Fix immediately. HIGH = pattern where the shell layer exists but user-input reachability needs verification. Step 3 — Remediation The universal fix: pass arguments as a list (array), not a single string. Most APIs have a list form that bypasses shell entirely. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/detecting-command-injection-patterns