| name | detecting-command-injection-patterns |
| description | Scan a source tree for command-injection vulnerable patterns:
shell=True calls in Python subprocess, os.system / os.popen with
interpolated strings, Node child_process.exec with template
literals, Ruby backticks / Kernel#system / Kernel#exec with
interpolation, Go exec.Command with shell wrapping, PHP system /
passthru / shell_exec / backticks with $-interpolation, Java
Runtime.exec with concatenated args.
Use when: pre-commit gate on code that calls out to shell utilities,
audit of file-processing / archive-handling / image-conversion
code, post-bug-report investigation for "we shell out to a tool."
Threshold: any shell-invocation API called with a string that
contains a variable interpolation, OR shell=True with anything
other than a fixed literal.
Trigger with: "scan command injection", "shell=True audit",
"find exec calls", "check os.system".
|
| allowed-tools | ["Read","Bash(python3:*)","Glob","Grep"] |
| disallowed-tools | ["Bash(rm:*)","Bash(curl:*)"] |
| version | 3.30.0 |
| author | Jeremy Longshore <jeremy@intentsolutions.io> |
| license | MIT |
| compatibility | Designed for Claude Code |
| tags | ["security","static-analysis","command-injection","pentest"] |
Detecting Command Injection Patterns
Overview
Command injection (CWE-78, OWASP A03:2021) shows up wherever an
application shells out to a binary. Image conversion (convert),
archive extraction (tar, unzip), video processing (ffmpeg),
DNS lookup (dig), and "we just need to call this CLI tool once"
are the common origins.
The vulnerability shape is universal: a string is built including
user input, then handed to a shell interpreter. The shell parses
the string with normal shell semantics — including ;, |, &,
$(), backticks. Any of those in the user-controlled portion
becomes shell-executable.
When the skill produces findings
| Finding | Severity | Threshold | Affected control |
|---|
Python subprocess.run(..., shell=True) with interpolation | CRITICAL | f-string / concat / format argument with shell=True | CWE-78 |
Python os.system(...) with interpolation | CRITICAL | non-literal argument | CWE-78 |
Python os.popen(...) with interpolation | CRITICAL | non-literal argument | CWE-78 |
Node child_process.exec(...) with template literal | CRITICAL | ${...} in the command string | CWE-78 |
Node child_process.execSync(...) with template | CRITICAL | same | CWE-78 |
| Ruby backticks with interpolation | CRITICAL | `cmd #{var}` | CWE-78 |
Ruby Kernel#system(string) with interpolation | CRITICAL | system("cmd #{var}") | CWE-78 |
Go exec.Command("sh", "-c", ...) with interpolation | HIGH |
