Command-Injection Skill
Takes a caller-supplied parameter and passes it directly to subprocess.run.
Function parameter flows into subprocess.run — TT5 (crit) fires.
npx skillmds@latest add gl0di/cmdskill Takes a caller-supplied parameter and passes it directly to subprocess.run.
gl0di/clawseccheck/tree/main/fixtures/bad_taint_cmdinject/skills/cmdskill commit d39e6d7f2e