detecting-command-injection-patterns

name	detecting-command-injection-patterns
description	Scan a source tree for command-injection vulnerable patterns: shell=True calls in Python subprocess, os.system / os.popen with interpolated strings, Node child_process.exec with template literals, Ruby backticks / Kernel#system / Kernel#exec with interpolation, Go exec.Command with shell wrapping, PHP system / passthru / shell_exec / backticks with $-interpolation, Java Runtime.exec with concatenated args. Use when: pre-commit gate on code that calls out to shell utilities, audit of file-processing / archive-handling / image-conversion code, post-bug-report investigation for "we shell out to a tool." Threshold: any shell-invocation API called with a string that contains a variable interpolation, OR shell=True with anything other than a fixed literal. Trigger with: "scan command injection", "shell=True audit", "find exec calls", "check os.system".
allowed-tools	["Read","Bash(python3:*)","Glob","Grep"]
disallowed-tools	["Bash(rm:*)","Bash(curl:*)"]
version	3.30.0
author	Jeremy Longshore <[e-mail]>
license	MIT
compatibility	Designed for Claude Code
tags	["security","static-analysis","command-injection","pentest"]

Detecting Command Injection Patterns

Overview

Command injection (CWE-78, OWASP A03:2021) shows up wherever an application shells out to a binary. Image conversion (convert), archive extraction (tar, unzip), video processing (ffmpeg), DNS lookup (dig), and "we just need to call this CLI tool once" are the common origins.

The vulnerability shape is universal: a string is built including user input, then handed to a shell interpreter. The shell parses the string with normal shell semantics — including ;, |, &, $(), backticks. Any of those in the user-controlled portion becomes shell-executable.

When the skill produces findings

Finding	Severity	Threshold	Affected control
Python subprocess.run(..., shell=True) with interpolation	CRITICAL	f-string / concat / format argument with shell=True	CWE-78
Python os.system(...) with interpolation	CRITICAL	non-literal argument	CWE-78
Python os.popen(...) with interpolation	CRITICAL	non-literal argument	CWE-78
Node child_process.exec(...) with template literal	CRITICAL	${...} in the command string	CWE-78
Node child_process.execSync(...) with template	CRITICAL	same	CWE-78
Ruby backticks with interpolation	CRITICAL	`cmd #{var}`	CWE-78
Ruby Kernel#system(string) with interpolation	CRITICAL	system("cmd #{var}")	CWE-78
Go exec.Command("sh", "-c", ...) with interpolation	HIGH