subprocess module call
Medium
- Category
- Dangerous Code Execution
- Content
def run(cmd): p = subprocess.run(cmd, shell=True, text=True, capture_output=True) if p.returncode != 0: raise RuntimeError(f'cmd failed: {cmd}\nstdout={p.stdout}\nstderr={p.stderr}') lines = [ln for ln in p.stdout.splitlines() if not ln.startswith('[lark-claw]')]- Confidence
- 96% confidence
- Finding
- The script builds shell command strings and executes them with subprocess.run(..., shell=True). Although some payloads are single-quote escaped, other user-influenced values such as the tool name and command structure are still passed through a shell, which creates command-injection risk and makes safety depend on fragile manual quoting. In an automation skill that may process project names, titles, and external content, this is more dangerous because the script is meant to run unattended and transmit data externally.