Argv List-Form Skill
Passes a caller-supplied value as a non-program element of a fixed argv list with
shell=False. Shell metacharacters are literal argv data, so this is not command
injection and must not be a CRITICAL vet failure.
Argvskill
Caller input flows into a fixed-program subprocess argv list (shell=False) — argument injection only, not command injection. B13 FP regression guard.
gl0di
Updated Argvskill by gl0di · acd32bb
npx skillmds@latest add gl0di/argvskill File contents
---name: argvskilldescription: Caller input flows into a fixed-program subprocess argv list (shell=False) — argument injection only, not command injection. B13 FP regression guard.---# Argv List-Form SkillPasses a caller-supplied value as a non-program element of a fixed argv list with`shell=False`. Shell metacharacters are literal argv data, so this is not commandinjection and must not be a CRITICAL vet failure.
gl0di/clawseccheck/tree/main/fixtures/clean_taint_argv_listform/skills/argvskill commit acd32bb9ca
Frequently asked questions
Run npx skillmds@latest add gl0di/argvskill in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Caller input flows into a fixed-program subprocess argv list (shell=False) — argument injection only, not command injection. B13 FP regression guard. It is listed under Coding & Dev Tools on SkillMD.
This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
gl0di (@gl0di) published this skill. Their other Agent Skills are listed on their SkillMD profile.