subprocess module call
Medium
- Category
- Dangerous Code Execution
- Content
def run_cmd(cmd, timeout=10): """Run a shell command and return output.""" try: result = subprocess.run( cmd, shell=True, capture_output=True, text=True, timeout=timeout ) return result.stdout.strip(), result.stderr.strip(), result.returncode- Confidence
- 99% confidence
- Finding
- run_cmd executes arbitrary strings with subprocess.run(..., shell=True), which enables shell injection if any part of cmd is influenced by user input, package names, session names, or other external data. In this skill, the helper is reused by package/session/tmux functions, making the attack surface broad and especially dangerous because the skill explicitly controls robot operations and system state.