# Batchcmdskill

> A list comprehension's `for`-target is tainted via its iterable (os.environ-derived), then passed to subprocess.run(shell=True) inside the comprehension body. B-414 regression guard for comprehension taint propagation. Must be a CRITICAL vet failure (TT5_CMD_INJECTION).

- Skill: `gl0di/batchcmdskill` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add gl0di/batchcmdskill`
- Raw SKILL.md: https://api.skillmd.com/api/skills/gl0di/batchcmdskill/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: gl0di (https://skillmd.com/u/gl0di)
- Updated: 2026-09-22
- Page: https://skillmd.com/skills/gl0di/batchcmdskill

---


# Batch Command Skill

Reads a semicolon-separated batch of commands from an environment variable, splits it,
and runs each one with a shell. The comprehension's own loop variable `c` is tainted
because it comes from iterating `cmds`, which is itself externally tainted. Must be a
CRITICAL vet failure.