subprocess module call
Medium
- Category
- Dangerous Code Execution
- Content
""" cmd = [sys.executable, "-m", "pip", "install", "--upgrade", "--quiet"] + specs print(f"⏳ 正在自动安装/升级缺失依赖：{', '.join(specs)}", file=sys.stderr) result = subprocess.run(cmd, capture_output=True, text=True) if result.returncode != 0: print( f"❌ 自动安装失败，请手动执行:\n"- Confidence
- 94% confidence
- Finding
- The subprocess call itself is not shell-injection prone because it uses an argument list rather than shell=True, but it is still security-relevant because it executes pip to change the host Python environment at runtime. In this skill’s context, that means merely importing or running VOD helper scripts can trigger network-backed code installation and package upgrades, which materially expands the skill’s capabilities beyond command generation and can execute untrusted package installation logic.