subprocess module call
Medium
- Category
- Dangerous Code Execution
- Content
def run_cmd(args): """运行估算命令""" cmd = f"python3 estimate.py {' '.join(str(a) for a in args)}" result = subprocess.run(cmd, shell=True, capture_output=True, text=True) return result def test_case(args, expected_keys=None):- Confidence
- 99% confidence
- Finding
- The script builds a shell command by concatenating arguments into a single string and executes it with shell=True. If any argument is attacker-controlled, shell metacharacters can inject arbitrary commands, which is especially dangerous because the skill’s domain only requires passing estimator inputs, not shell interpretation.