Django Project Creator

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:58 PM UTC
• Version: 1.0.0

Overview

This skill appears to be a Django project scaffolder, but its bundled script can run unintended shell commands from ordinary project-name, app-name, path, or model-name input.

Treat this as a Review item before installing. Only run it in a disposable directory or isolated environment, never with untrusted names or paths, and prefer a revised version that validates Django identifiers, writes files with Python APIs, uses subprocess argument lists, and pins dependencies.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (4)

T09 · Insecure Skill Coding Practices

Error

• Location: scriptBackend.py:151

Finding

OS Command Injection Through Unvalidated Project Inputs

Content

View full analysis

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Error

• Location: scriptBackend.py:135

Finding

Shell and Persistent Python Code Injection Through Model Names

Content

View full analysis

> models.py''') os.chdir('../') run_command(f'python3 manage.py makemigrations') run_command(f'python3 manage.py migrate') ``` ### Technical Analysis Every model name is embedded directly into a shell-backed `echo` command without validation. A crafted value can affect the shell command through quoting, command substitution, redirection, or command separators. The value is also inserted into Python source code as a class name. This creates a second injection boundary: a value that changes the generated Python syntax can persist attacker-controlled code in `models.py`. Django imports model modules during management operations and application startup, so malicious generated code may execute later even if immediate shell injection is avoided. ### Attack Path 1. The attacker selects the model-configuration option. 2. The attacker submits one or more crafted model names containing shell syntax or Python source fragments. 3. The script places each value inside the command passed to `os.system()`. 4. Shell syntax can execute immediately with the script user's privileges. 5. Alternatively, injected Python can be appended to `models.py`. 6. The script subsequently runs `makemigrations` and `migrate`, which load Django application modules and may execute the injected Python. 7. Persisted injected code can also execute whenever the generated D ...[truncated 504 chars]

Remediation

View remediation

T09 · Insecure Skill Coding Practices

Warning

• Location: scriptBackend.py:45

Finding

Unsafe Shell-Based Generation of Django Source Files

Content

View full analysis

urls.py''') os.system(f'''echo "from django.shortcuts import render # Create your views here. def YOUR_VIEW(request): pass" > views.py ''') os.chdir(f'../{projectName}') searchItem = 'django.contrib.staticfiles' with open('settings.py', 'r') as file: lines = file.readlines() for index, line in enumerate(lines, start=1): if searchItem in line: lines.insert(index, f'\t\'{appName}\'\n') break with open('settings.py', 'w') as f: f.writelines(lines) os.system(f'''echo "from django.contrib import admin from django.urls import path, include urlpatterns = [ path('admin/', admin.site.urls), path('{appName}/', include('{appName}.urls')), ]" > urls.py''') ``` The REST setup uses the same pattern: ```python os.system(f'''echo "from rest_framework_nested import routers from .views import * router = routers.DefaultRouter() router.register('UR_ROUTE', ViewSet) urlpatterns = router.urls" > urls.py''') os.system(f'''echo "from rest_framework.viewsets import ModelViewSet from .models import * from .serializers import * class ViewSet(ModelViewSet): pass" > views.py ''') os.chdir(f'../{projectName}') os.system(f'''echo "from django.contrib import admin from django.urls import path, include urlpatterns = [ path('admin/', admin.site.urls), path('{appName}/', include('{appName}.urls')), ]" > urls.py''') ``` ### Technical Analysis The script generates source files by constructing multiline shell commands. In particular, `appName` is inserted into shel ...[truncated 1477 chars]

Remediation

View remediation

T08 · Insecure Dependencies

Warning

• Location: scriptBackend.py:80

Finding

Unpinned Dependency Installation and Ineffective Virtual-Environment Isolation

Content

View full analysis

Remediation

View remediation

SkillSpector

Vulnerability Patterns

• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep
• Behavioral AST: exec() Call, eval() Call, Dynamic Import
• Taint Tracking: Direct Taint Flow, Variable-Mediated Taint Flow, Credential Exfiltration Chain
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration

Findings (27)

Tainted flow: 'appName' from input (line 169, user input) → os.system (code execution)

Critical

• Category: Data Flow
• Confidence: 100% confidence

Finding

This is a confirmed tainted data flow from appName input to os.system. In the context of a scaffolding skill that encourages users to enter arbitrary names, this makes exploitation realistic and dangerous because the script is expected to run on a developer workstation with write access.

Content

Scanner excerpt · scriptBackend.py (reported line 69)May include surrounding context.

python

break
    with open('settings.py', 'w') as f:
        f.writelines(lines)
    os.system(f'''echo "from django.contrib import admin
from django.urls import path, include

urlpatterns = [

Tainted flow: 'appName' from input (line 169, user input) → os.system (code execution)

Critical

• Category: Data Flow
• Confidence: 100% confidence

Finding

This is another confirmed appName-to-shell injection path in a code-generation step. Since the script modifies project files automatically, arbitrary command execution here could also tamper with the project, install backdoors, or exfiltrate local data.

Content

Scanner excerpt · scriptBackend.py (reported line 113)May include surrounding context.

python

''')

    os.chdir(f'../{projectName}')
    os.system(f'''echo "from django.contrib import admin
from django.urls import path, include

urlpatterns = [

Tainted flow: 'path' from input (line 27, user input) → os.system (code execution)

Critical

• Category: Data Flow
• Confidence: 100% confidence

Finding

This is a confirmed tainted flow from path input into an os.system invocation. Because path values commonly include spaces and shell-significant characters, this is especially easy to misuse and can result in arbitrary command execution before the rest of the project is even created.

Content

Scanner excerpt · scriptBackend.py (reported line 154)May include surrounding context.

python

answer = input(f'{color.YELLOW}Would you like to create a venv in the desired directory: {color.END}')

    if answer.lower() == 'yes' or answer.lower() == 'y':
        os.system(f'python3 -m venv {path}.venv')
        loading('Creating Virtual Envirement', 1)

    projectName = input(f'{color.YELLOW}Choose a name for your project: {color.END}')

Tainted flow: 'projectName' from input (line 157, user input) → os.system (code execution)

Critical

• Category: Data Flow
• Confidence: 100% confidence

Finding

This is a direct tainted flow from projectName input to os.system('django-admin startproject ...'). The context increases risk because project setup tools are commonly run by developers with significant local permissions, so successful injection can fully compromise the workstation or CI environment.

Content

Scanner excerpt · scriptBackend.py (reported line 166)May include surrounding context.

python

os.chdir(path)
    os.system('source .venv/bin/activate')
    run_command('pip install django')
    os.system(f'django-admin startproject {projectName}')
    os.chdir(f'{path}{projectName}')

    appName = input(f'{color.YELLOW}Choose a name for your app: {color.END}')

Tainted flow: 'appName' from input (line 169, user input) → os.system (code execution)

Critical

• Category: Data Flow
• Confidence: 90% confidence

Finding

External input (network, user) flows to a code execution sink. This enables remote code execution or command injection.

Content

Scanner excerpt · scriptBackend.py (reported line 171)May include surrounding context.

python

appName = input(f'{color.YELLOW}Choose a name for your app: {color.END}')

    os.system(f'django-admin startapp {appName}')

    create = input(f'{color.YELLOW}would you like to create a requirements file: {color.END}')
    if create.lower() == 'yes' or create.lower() == 'y':

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 16)May include surrounding context.

python

END = '\033[0m'
   CYAN_BG = '\33[1;37;40m'

os.system('clear')

print(f'''{color.PURPLE}{color.BOLD}
\t                        _           __                          __

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 46)May include surrounding context.

python

def DjangoNoRest():
    os.chdir(appName)
    os.system('touch urls.py')
    os.system(f'''echo "from django.urls import path
from .views import *

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 94)May include surrounding context.

python

def DjangoNoRest():
    os.chdir(appName)
    os.system('touch urls.py')
    os.system(f'''echo "from django.urls import path
from .views import *

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 47)May include surrounding context.

python

def DjangoNoRest():
    os.chdir(appName)
    os.system('touch urls.py')
    os.system(f'''echo "from django.urls import path
from .views import *

urlpatterns = [

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 53)May include surrounding context.

python

urlpatterns = [
    path('AppRoute/', YOUR_VIEW),
]" > urls.py''')
    os.system(f'''echo "from django.shortcuts import render

# Create your views here.
def YOUR_VIEW(request):

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

This shell command interpolates appName, which is taken from user input, into an os.system call. An attacker can supply shell metacharacters in the app name to break out of the intended command and execute arbitrary commands on the host.

Content

Scanner excerpt · scriptBackend.py (reported line 69)May include surrounding context.

python

break
    with open('settings.py', 'w') as f:
        f.writelines(lines)
    os.system(f'''echo "from django.contrib import admin
from django.urls import path, include

urlpatterns = [

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 95)May include surrounding context.

python

with open(f'../{projectName}/settings.py', 'w') as f:
        f.writelines(lines)
    os.system('touch urls.py')
    os.system('touch serializers.py')
    os.system(f'''echo "from rest_framework_nested import routers
from .views import *

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 96)May include surrounding context.

python

f.writelines(lines)
    os.system('touch urls.py')
    os.system('touch serializers.py')
    os.system(f'''echo "from rest_framework_nested import routers
from .views import *

router = routers.DefaultRouter()

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 104)May include surrounding context.

python

urlpatterns = router.urls" > urls.py''')

    os.system(f'''echo "from rest_framework.viewsets import ModelViewSet
from .models import *
from .serializers import *

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

This shell command interpolates appName into an os.system call when generating Django URL configuration. Because appName comes from user input, crafted input can trigger arbitrary shell command execution with the privileges of the script runner.

Content

Scanner excerpt · scriptBackend.py (reported line 113)May include surrounding context.

python

''')

    os.chdir(f'../{projectName}')
    os.system(f'''echo "from django.contrib import admin
from django.urls import path, include

urlpatterns = [

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

module values come from user input and are interpolated into a shell echo command that appends to models.py. This creates both command-injection risk and code-generation risk, allowing arbitrary shell execution or malicious Python code insertion into the generated project.

Content

Scanner excerpt · scriptBackend.py (reported line 140)May include surrounding context.

python

splitted = modulsName.split(', ')
    os.chdir(appName)
    for module in splitted:
        os.system(f'''echo "class {module}(models.Model):
    name = models.CharField(max_length=255, unique=True)

    def __str__(self):

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

The path value is user-supplied and directly inserted into an os.system command for virtual environment creation. Crafted path input can break command boundaries and execute arbitrary OS commands.

Content

Scanner excerpt · scriptBackend.py (reported line 154)May include surrounding context.

python

answer = input(f'{color.YELLOW}Would you like to create a venv in the desired directory: {color.END}')

    if answer.lower() == 'yes' or answer.lower() == 'y':
        os.system(f'python3 -m venv {path}.venv')
        loading('Creating Virtual Envirement', 1)

    projectName = input(f'{color.YELLOW}Choose a name for your project: {color.END}')

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 164)May include surrounding context.

python

exit(1)
    
    os.chdir(path)
    os.system('source .venv/bin/activate')
    run_command('pip install django')
    os.system(f'django-admin startproject {projectName}')
    os.chdir(f'{path}{projectName}')

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

projectName is taken from user input and inserted directly into an os.system command. A malicious project name containing shell metacharacters can execute arbitrary commands, making this a straightforward command injection leading to full code execution on the local system.

Content

Scanner excerpt · scriptBackend.py (reported line 166)May include surrounding context.

python

os.chdir(path)
    os.system('source .venv/bin/activate')
    run_command('pip install django')
    os.system(f'django-admin startproject {projectName}')
    os.chdir(f'{path}{projectName}')

    appName = input(f'{color.YELLOW}Choose a name for your app: {color.END}')

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 99% confidence

Finding

This command directly interpolates appName from user input into a shell command. An attacker can provide a crafted app name to achieve arbitrary command execution during project scaffolding.

Content

Scanner excerpt · scriptBackend.py (reported line 171)May include surrounding context.

python

appName = input(f'{color.YELLOW}Choose a name for your app: {color.END}')

    os.system(f'django-admin startapp {appName}')

    create = input(f'{color.YELLOW}would you like to create a requirements file: {color.END}')
    if create.lower() == 'yes' or create.lower() == 'y':

os.system() or os exec-family call

High

• Category: Dangerous Code Execution
• Confidence: 85% confidence

Finding

os.system() and os exec-family calls run shell commands with the process's full privileges, enabling arbitrary command execution.

Content

Scanner excerpt · scriptBackend.py (reported line 175)May include surrounding context.

python

create = input(f'{color.YELLOW}would you like to create a requirements file: {color.END}')
    if create.lower() == 'yes' or create.lower() == 'y':
        os.system('pip freeze > requirements.txt')
    
    setup = input(f'{color.YELLOW}you want to set up the files for django ? (yes or no): {color.END}')

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 93% confidence

Finding

No manifest is available, so there is no declared purpose that would justify broad command-execution capabilities. The code clears the terminal, creates virtual environments, invokes django-admin/manage.py, and runs pip installs through os.system/subprocess, which is a powerful capability beyond a minimally justified unknown-purpose skill.

Content

No source excerpt is available for this finding.

Context-Inappropriate Capability

Medium

• Category: Not specified by scanner
• Confidence: 91% confidence

Finding

The code creates and overwrites project files such as urls.py, views.py, serializers.py, requirements.txt, and settings.py, and changes directories throughout execution. With no manifest or declared scope, this level of write access is not justified by any stated intent and materially changes local developer projects.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 89% confidence

Finding

This code creates and overwrites project files such as urls.py, views.py, settings.py, serializers.py, and requirements.txt, and also creates virtual environments and Django projects. While there are status messages after some actions, there is no clear user-facing warning that the script will modify files and project structure in the selected path before those operations occur.

Content

No source excerpt is available for this finding.

Missing User Warnings

Medium

• Category: Not specified by scanner
• Confidence: 86% confidence

Finding

The script installs packages with pip, creates a virtual environment, runs django-admin, and executes manage.py commands, all of which change the local environment and system state. Although some success/error messages are printed, the user is not explicitly warned that dependencies will be installed and commands executed on their system.

Content

No source excerpt is available for this finding.

Static analysis

No suspicious patterns detected.