Agent skill · security · jeremylongshore
detecting-eval-exec-usage
Scan a source tree for dynamic-code-execution APIs that an attacker can hijack: Python eval / exec / compile, JavaScript eval / Function() / setTimeout(string), Ruby eval / instance_eval / class_eval, Java ScriptEngine, PHP eval / assert($str), .NET Activator.CreateInstance / Reflection.Emit with dynamic input. Use when: pre-commit gate on any application that parses user-uploaded code (rule engines, formula evaluators, plugin systems), or post-bug-report when "we run user-supplied expressions." Threshold: any call to eval / exec / Function / similar where the argument is not a string literal. Trigger with: "scan eval", "find dynamic exec", "audit eval calls", "code injection patterns".
Why this skill is useful
Adds a script that scans for dynamic code execution vulnerabilities, providing critical security insights not commonly known.
What it needs
Requires python3 installed locally. About 2k tokens when loaded. Last updated 2026-08-07. 2,604 stars on the source repository.
What this skill does
Detecting eval / exec Usage Overview Dynamic-code-execution APIs (CWE-95 Eval Injection) let an application interpret a string as code at runtime. If the string contains anything user-controllable, the application has handed the attacker arbitrary code execution. The defensive posture: don't use these APIs. The exceptions are narrow: rule engines, formula evaluators (spreadsheet = formulas), plugin systems with explicit sandboxing. For everything else, there's almost always a safer alternative. When the skill produces findings Finding Severity Threshold Affected control --- --- --- --- Python eval(...) with non-literal CRITICAL argument contains var ref CWE-95 Python exec(...) with non-literal CRITICAL argument contains var ref CWE-95 Python compile(...) with non-literal HIGH source string contains var CWE-95 Python import(var) HIGH dynamic module loading CWE-95 JS eval(...) CRITICAL any CWE-95 JS new Function(str) CRITICAL any non-literal CWE-95 JS setTimeout/setInterval(string) HIGH string instead of function CWE-95 Ruby eval(...)/instanceeval(...)/classeval(...) CRITICAL non-literal CWE-95 PHP eval(...) CRITICAL always CWE-95 PHP assert($str) CRITICAL (legacy code-eval form) CWE-95 PHP createfunction CRITICAL deprecated, eval-equivalent CWE-95 Java ScriptEngineManager + eval HIGH dynamic script execution CWE-95 C# Activator.CreateInstance(Type.GetType(str)) HIGH type loading from string CWE-95 Prerequisites Python 3.9+ Source tree on local filesystem Instructions Run Options: --output FILE, --format json jsonl markdown, --min-severity, --include-tests, --languages LIST. Interpret CRITICAL = direct RCE vector. Replace the dynamic execution with explicit logic (lookup table, switch statement) or a sandboxed expression library (Python simpleeval, JavaScript expr-eval, Ruby Dentaku). Remediation See references/PLAYBOOK.md. Examples Pre-commit CI Output JSON / JSONL / Markdown. Exit codes: 0 / 1 / 2. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills jeremylongshore/detecting-eval-exec-usage--16af7b