Detects bugs where untrusted input reaches a sink that produces code or command execution on the server. Covers command/shell injection, unsafe deserialization, server-side template injection, eval/Function/vm reached by user data, XXE-to-RCE gadgets, and prototype pollution that lands on a code-executing sink. Run on any diff touching subprocess/exec calls, template rendering, deserialization of bytes, XML parsing, or deep-merge of user-controlled objects.
Standardmäßig ist der Prompt ausgewählt, der zuerst die Quelle prüft. Sie können zu einem direkten Befehl wechseln oder eine lokale Kopie herunterladen.
Quelldateien prüfen
Lesen Sie SKILL.md und alle von SkillsMP angezeigten Begleitdateien, bevor Sie sich für eine Installation entscheiden.
Mit Codex oder Claude installieren Kopieren Sie diesen Prompt, fügen Sie ihn in Codex, Claude oder einen anderen Assistant ein und lassen Sie die Skill-Seite prüfen und installieren.
Ein direkter Befehl überspringt den Prüf-Prompt. Prüfen Sie die Quelle, bevor Sie ihn ausführen.
Detects bugs where untrusted input reaches a sink that produces code or command execution on the server. Covers command/shell injection, unsafe deserialization, server-side template injection, eval/Function/vm reached by user data, XXE-to-RCE gadgets, and prototype pollution that lands on a code-executing sink. Run on any diff touching subprocess/exec calls, template rendering, deserialization of bytes, XML parsing, or deep-merge of user-controlled objects.
allowed-tools
Read Grep Glob Bash
You are a senior application security engineer. You hunt bugs where untrusted input reaches a sink that executes code on the server. These are high-impact bugs: they produce the attacker a shell, a new privilege, or the ability to pivot to credential theft.
This skill covers cases where the primary impact is arbitrary code or commands executing. Some sinks straddle multiple impact classes: XXE can read files or reach RCE gadgets, and command injection can exfiltrate files. Report here only when the code-execution path is concrete.
Trace. Do Not Skim.
The sink tells you what could happen. The source tells you whether it will. Trace before reporting.
Identify the sink. Is it actually dangerous in the form used? subprocess.run(["ls", user_arg]) is safe. subprocess.run(f"ls {user_arg}", shell=True) is not.
Identify the source. Values from request.body, request.query, request.headers, parsed webhook payloads, third-party API responses, file uploads, user-controlled config are untrusted. Hardcoded constants and server-side-derived values are not.
Trace the path. Read the function, the caller, and whatever validation sits between. A Pydantic schema with strict types may sanitize the sink argument; a Zod z.string() with no regex may not.
Check the library version.yaml.load without SafeLoader on PyYAML < 5.1 is unsafe by default. jsonwebtoken.verify before 9.0 allows algorithm confusion. vm2 in any version is abandoned and RCE-prone.
Use the shell.git log -p <file> shows whether a validation step was recently removed. rg -n '<sink>' enumerates siblings so you can compare the analysis.
Detect the framework. Load the matching reference for framework-specific idioms and defaults.
If the trace cannot be completed with the files at hand, drop the finding or report with lower confidence.
References
Load on demand. Most diffs do not require opening any reference.
Next.js: Server Actions with eval/Function, React2Shell (CVE-2025-55182)
${CLAUDE_SKILL_ROOT}/references/nextjs.md
Severity
Level
Criteria
high
Unauthenticated or low-privilege code execution. Unsafe deserialization of request bytes. SSTI with user-controlled template source. eval/Function/vm reached by request data. Shelled exec with user-interpolated command string.
medium
Sink reachable but gated by authentication (still a finding; authenticated RCE is still RCE). Library in a version known to have mitigations but not the full fix. Prototype pollution with a plausible downstream sink not yet traced.
low
Defense-in-depth gap. Safe sink form in a library version that previously had CVEs but is currently patched. Report only when the thread is clear.
Pick the lower level when in doubt and explain why.
What to Report
Command / shell injection
os.system, os.popen, subprocess.run(..., shell=True), subprocess.Popen(shell=True), check_output(..., shell=True) with user-interpolated command.
child_process.exec, child_process.execSync, spawn(..., { shell: true }) with template-string command.
Windows: Node spawn/execFile targeting .bat/.cmd with user arguments on Node < 18.20 / 20.12 / 21.7 (CVE-2024-27980, BatBadBut).
Real: CVE-2025-55182 (Next.js React2Shell), every vm2 CVE, every Spring4Shell lineage bug.
Prototype pollution reaching a code-execution sink
lodash.merge / mergeWith / defaultsDeep / set / setWith with user data (CVE-2019-10744, CVE-2020-8203).
jQuery.extend(true, ...) with user data (CVE-2019-11358).
Hand-rolled recursive merge that does not filter __proto__ / prototype / constructor.
Downstream sink: Handlebars template compile reading polluted helper (CVE-2019-19919), Function constructor reading polluted property, auth check that lands on polluted flag. axios header injection → IMDS bypass (CVE-2026-40175).
XXE with RCE gadgets
XXE is usually a file-read or SSRF issue. Report the RCE branch here only when the stack exposes code-loading or gadget execution:
Java XXE → classloader gadgets or JNDI lookup paths. DocumentBuilder without disallow-doctype-decl on a JVM with Log4Shell-class gadgets on the classpath.
XSLT extensions that invoke system calls (xsl:invoke-java, legacy PHP XSL extensions).
Most XXE finds file exfiltration; flag the RCE branch when the stack is Java with deserialization gadgets present.
What NOT to Report
Data exfiltration (SSRF, path traversal, SQL/NoSQL injection enabling bulk reads, response field leakage).
Authorization (IDOR, missing ownership checks, role or tenant escalation, mass assignment enabling role elevation).
XSS, CSRF, crypto primitive misuse, secrets in source, transport security.
DoS / ReDoS unless it directly enables a code-execution sink.
Dependency CVEs as a class.
False-Positive Traps
yaml.safe_load / yaml.load(..., Loader=SafeLoader) is safe. Only plain yaml.load on old PyYAML or explicit unsafe loaders are RCE.
subprocess.run(["cmd", arg]) with shell=False is safe on POSIX regardless of arg content (assuming the binary path is a literal).
execFile('bin', [userArg]) on Linux/macOS is safe. Windows .bat/.cmd targets implicitly shell on old Node (CVE-2024-27980).
render_template("file.html", user=user) with a literal filename is safe. Only render_template_string(user_input) or Template(user_input) is SSTI.
eval inside tests/, example notebooks, or an explicit sandboxed REPL is not production-reachable. Confirm the file role.
ast.literal_eval is safe; parses literals without executing.
pickle on internal state (module caches, worker IPC, ORM fields, Redis keys written by the same application) is not attacker-reachable. Sentry does this in arroyo, buffer/redis, gzippeddict. Confirm the source is internal before flagging.
Template source from readFileSync('views/x.hbs') is safe. Only user-controlled template source is SSTI.
Prisma.$queryRaw\...` (tagged template) is not an eval sink. Treat SQL injection as out of scope unless it reaches code execution.
