Django Project Creator

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:59 PM UTC
• Version: 1.0.0

Overview

This looks like a Django project scaffolding helper, but it runs shell commands built from user-entered names and paths, which can execute unintended local commands.

Review this before installing or running. Only use it in a disposable directory with trusted inputs, and preferably fix it first by replacing shell-string os.system calls with subprocess argument lists, validating Django identifiers, using pathlib for paths, and adding overwrite confirmations. I did not find evidence of exfiltration or persistence, so this is Review rather than malicious.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Error

• Location: scriptBackend.py:141

Finding

Shell Command Injection Through Unsanitized Project Parameters

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scriptBackend.py:124

Finding

Shell and Generated Python Code Injection Through Model Names

Content

View full analysis

> models.py''') os.chdir('../') ``` ### Technical Analysis Each user-provided model name is embedded directly into a shell command passed to `os.system`. Shell metacharacters and command substitutions in a model name can therefore be evaluated immediately by the shell. The same untrusted input is also inserted into generated Python source. A crafted value capable of breaking the intended class declaration can introduce attacker-controlled Python statements into `models.py`. Such code may execute later when Django imports the model module during migrations, application startup, testing, or request handling. This creates two execution opportunities: 1. Immediate operating-system command execution during scaffolding. 2. Delayed Python code execution when the poisoned generated module is imported. ### Attack Path 1. The user selects the model-configuration option. 2. A malicious model-name value containing shell syntax or Python source-breaking content is entered. 3. The value is interpolated into the `echo` command. 4. Shell syntax can execute immediately under the script user's account. 5. Any injected Python content written successfully to `models.py` remains in the generated project. 6. The subsequent migration commands or a later Django process imports the model module, potentially executing the injected Python payload. ### Impact As ...[truncated 671 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scriptBackend.py:72

Finding

Unpinned Runtime Installation of Third-Party Dependencies

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands

Findings (30)

Tainted flow: 'appName' from input (line 169, user input) → os.system (code execution)

Critical

• Category: Data Flow
• Confidence: 100% confidence

Finding

This is a confirmed tainted-flow command injection: appName originates from input() and reaches os.system inside a shell command that writes urls.py. Because the script is an interactive project scaffolder, users are expected to supply these values, which makes exploitability practical rather than theoretical.

Content

Scanner excerpt · scriptBackend.py (reported line 69)May include surrounding context.

python

break
    with open('settings.py', 'w') as f:
        f.writelines(lines)
    os.system(f'''echo "from django.contrib import admin
from django.urls import path, include

urlpatterns = [

Tainted flow: 'appName' from input (line 169, user input) → os.system (code execution)

Critical

• Category: Data Flow
• Confidence: 100% confidence

Finding

This is another confirmed user-input-to-shell sink where appName flows into os.system. The skill context increases danger because the script is intended to be run locally by developers, giving successful injection direct code execution on their workstation or CI environment.

Content

Scanner excerpt · scriptBackend.py (reported line 113)May include surrounding context.

python

''')

    os.chdir(f'../{projectName}')
    os.system(f'''echo "from django.contrib import admin
from django.urls import path, include

urlpatterns = [

Tainted flow: 'path' from input (line 27, user input) → os.system (code execution)

Critical

• Category: Data Flow
• Confidence: 100% confidence

Finding

This is a direct tainted-flow vulnerability from path input into os.system. In the context of a developer utility, the script is likely run with the user's normal filesystem permissions, so a successful injection can execute arbitrary local commands and modify source code or secrets.

Content

Scanner excerpt · scriptBackend.py (reported line 154)May include surrounding context.

python

answer = input(f'{color.YELLOW}Would you like to create a venv in the desired directory: {color.END}')

    if answer.lower() == 'yes' or answer.lower() == 'y':
        os.system(f'python3 -m venv {path}.venv')
        loading('Creating Virtual Envirement', 1)

    projectName = input(f'{color.YELLOW}Choose a name for your project: {color.END}')

Tainted flow: 'projectName' from input (line 157, user input) → os.system (code execution)

Critical

• Category: Data Flow
• Confidence: 100% confidence

Finding

projectName from input() is passed into a shell command that invokes django-admin startproject. Any shell metacharacter in projectName can break command boundaries and execute arbitrary commands, leading to full compromise of the executing user's environment.

Content

Scanner excerpt · scriptBackend.py (reported line 166)May include surrounding context.

python

os.chdir(path)
    os.system('source .venv/bin/activate')
    run_command('pip install django')
    os.system(f'django-admin startproject {projectName}')
    os.chdir(f'{path}{projectName}')

    appName = input(f'{color.YELLOW}Choose a name for your app: {color.END}')

Tainted flow: 'appName' from input (line 169, user input) → os.system (code execution)

Critical

• Category: Data Flow
• Confidence: 100% confidence

Finding

appName is directly tainted from user input and reaches a shell execution sink unchanged. This is straightforward command injection and can be exploited with minimal attacker control over the interactive input.

Content

Scanner excerpt · scriptBackend.py (reported line 171)May include surrounding context.

python

appName = input(f'{color.YELLOW}Choose a name for your app: {color.END}')

    os.system(f'django-admin startapp {appName}')

    create = input(f'{color.YELLOW}would you like to create a requirements file: {color.END}')
    if create.lower() == 'yes' or create.lower() == 'y':

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 16)May include surrounding context.

python

END = '\033[0m'
   CYAN_BG = '\33[1;37;40m'

os.system('clear')

print(f'''{color.PURPLE}{color.BOLD}
\t                        _           __                          __

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 46)May include surrounding context.

python

def DjangoNoRest():
    os.chdir(appName)
    os.system('touch urls.py')
    os.system(f'''echo "from django.urls import path
from .views import *

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 94)May include surrounding context.

python

def DjangoNoRest():
    os.chdir(appName)
    os.system('touch urls.py')
    os.system(f'''echo "from django.urls import path
from .views import *

Missing User Warnings

High

• Category: Not specified by scanner
• Confidence: 96% confidence

Finding

The helper functions use shell redirection and file writes to recreate urls.py, views.py, and serializers.py, which can destroy existing content. There is no confirmation prompt or explicit warning that these operations are destructive to pre-existing files.

Content

No source excerpt is available for this finding.

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 47)May include surrounding context.

python

def DjangoNoRest():
    os.chdir(appName)
    os.system('touch urls.py')
    os.system(f'''echo "from django.urls import path
from .views import *

urlpatterns = [

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 53)May include surrounding context.

python

urlpatterns = [
    path('AppRoute/', YOUR_VIEW),
]" > urls.py''')
    os.system(f'''echo "from django.shortcuts import render

# Create your views here.
def YOUR_VIEW(request):

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

This shell command interpolates appName, which comes from user input, into a command string passed to os.system. An attacker can supply shell metacharacters in the app name to execute arbitrary commands on the host while the script is generating Django files.

Content

Scanner excerpt · scriptBackend.py (reported line 69)May include surrounding context.

python

break
    with open('settings.py', 'w') as f:
        f.writelines(lines)
    os.system(f'''echo "from django.contrib import admin
from django.urls import path, include

urlpatterns = [

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 95)May include surrounding context.

python

with open(f'../{projectName}/settings.py', 'w') as f:
        f.writelines(lines)
    os.system('touch urls.py')
    os.system('touch serializers.py')
    os.system(f'''echo "from rest_framework_nested import routers
from .views import *

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 96)May include surrounding context.

python

f.writelines(lines)
    os.system('touch urls.py')
    os.system('touch serializers.py')
    os.system(f'''echo "from rest_framework_nested import routers
from .views import *

router = routers.DefaultRouter()

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 104)May include surrounding context.

python

urlpatterns = router.urls" > urls.py''')

    os.system(f'''echo "from rest_framework.viewsets import ModelViewSet
from .models import *
from .serializers import *

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

This command again embeds user-supplied appName inside a shell command string. Because os.system invokes a shell, crafted input can break out of the intended echo statement and run arbitrary commands on the machine.

Content

Scanner excerpt · scriptBackend.py (reported line 113)May include surrounding context.

python

''')

    os.chdir(f'../{projectName}')
    os.system(f'''echo "from django.contrib import admin
from django.urls import path, include

urlpatterns = [

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

module values come from user input and are inserted into a shell echo command that appends Python code to models.py. An attacker can inject shell syntax to execute arbitrary commands, and can also inject malicious Python source into the generated application.

Content

Scanner excerpt · scriptBackend.py (reported line 140)May include surrounding context.

python

splitted = modulsName.split(', ')
    os.chdir(appName)
    for module in splitted:
        os.system(f'''echo "class {module}(models.Model):
    name = models.CharField(max_length=255, unique=True)

    def __str__(self):

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

The path variable is user-controlled and embedded in an os.system call for virtualenv creation. A crafted path containing command separators or subshell syntax can result in arbitrary command execution on the host.

Content

Scanner excerpt · scriptBackend.py (reported line 154)May include surrounding context.

python

answer = input(f'{color.YELLOW}Would you like to create a venv in the desired directory: {color.END}')

    if answer.lower() == 'yes' or answer.lower() == 'y':
        os.system(f'python3 -m venv {path}.venv')
        loading('Creating Virtual Envirement', 1)

    projectName = input(f'{color.YELLOW}Choose a name for your project: {color.END}')

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 164)May include surrounding context.

python

exit(1)
    
    os.chdir(path)
    os.system('source .venv/bin/activate')
    run_command('pip install django')
    os.system(f'django-admin startproject {projectName}')
    os.chdir(f'{path}{projectName}')

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

projectName is taken from user input and inserted directly into os.system('django-admin startproject ...'). A malicious project name containing shell metacharacters can trigger arbitrary command execution under the privileges of the user running the script.

Content

Scanner excerpt · scriptBackend.py (reported line 166)May include surrounding context.

python

os.chdir(path)
    os.system('source .venv/bin/activate')
    run_command('pip install django')
    os.system(f'django-admin startproject {projectName}')
    os.chdir(f'{path}{projectName}')

    appName = input(f'{color.YELLOW}Choose a name for your app: {color.END}')

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

This command directly interpolates attacker-controlled appName into an os.system call. An adversary can exploit this to execute arbitrary shell commands instead of merely creating a Django app.

Content

Scanner excerpt · scriptBackend.py (reported line 171)May include surrounding context.

python

appName = input(f'{color.YELLOW}Choose a name for your app: {color.END}')

    os.system(f'django-admin startapp {appName}')

    create = input(f'{color.YELLOW}would you like to create a requirements file: {color.END}')
    if create.lower() == 'yes' or create.lower() == 'y':

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 175)May include surrounding context.

python

create = input(f'{color.YELLOW}would you like to create a requirements file: {color.END}')
    if create.lower() == 'yes' or create.lower() == 'y':
        os.system('pip freeze > requirements.txt')
    
    setup = input(f'{color.YELLOW}you want to set up the files for django ? (yes or no): {color.END}')

Vague Triggers

Medium

• Category: Not specified by scanner
• Confidence: 87% confidence

Finding

The skill description is very broad and markets automatic environment provisioning and project bootstrapping without clearly defining when the skill should activate or what inputs and boundaries govern its behavior. In an agent ecosystem, vague trigger scope can cause the skill to be invoked in unintended contexts, leading to overbroad actions such as provisioning environments or applying defaults when the user did not explicitly request them.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 82% confidence

Finding

No manifest is available, so the skill's intended purpose is unknown. Across the file, the code changes directories, installs packages, creates virtual environments, starts Django projects/apps, runs migrations, and writes source files via shell commands, which are broad system-modifying capabilities that are not justified by any declared purpose.

Content

No source excerpt is available for this finding.

Tainted flow: 'projectName' from input (line 157, user input) → open (file write)

Medium

• Category: Data Flow
• Confidence: 84% confidence

Finding

projectName influences the path used for writing settings.py, creating a path traversal or arbitrary file overwrite risk if malicious values such as ../ segments are accepted. Although the script appears aimed at local scaffolding, overwriting attacker-chosen files on the host can still damage the environment or plant malicious configuration.

Content

Scanner excerpt · scriptBackend.py (reported line 92)May include surrounding context.

python

lines.insert(index, f'\t\'{appName}\'\n')
            lines.insert(index, '\t\'rest_framework\',\n')
            break
    with open(f'../{projectName}/settings.py', 'w') as f:
        f.writelines(lines)
    os.system('touch urls.py')
    os.system('touch serializers.py')

Static analysis

No suspicious patterns detected.