subprocess module call
Medium
- Category
- Dangerous Code Execution
- Content
def run(cmd, timeout=15): log(f"→ {cmd[:120]}") result = subprocess.run(cmd, shell=True, capture_output=True, text=True, timeout=timeout) if result.returncode != 0 and result.stderr: log(f" stderr: {result.stderr[:200]}") return result- Confidence
- 98% confidence
- Finding
- The helper wraps shell execution with subprocess.run(..., shell=True) and is later fed command strings that interpolate user-controlled values such as contact names and message text into shell commands. This creates a command injection path where crafted input containing shell metacharacters could execute arbitrary commands on the host running the skill.