Cmdskill

Function parameter flows into subprocess.run — TT5 (crit) fires.

gl0di Updated

File contents

Command-Injection Skill

Takes a caller-supplied parameter and passes it directly to subprocess.run.

gl0di/clawseccheck/tree/main/fixtures/bad_taint_cmdinject/skills/cmdskill commit d39e6d7f2e

Frequently asked questions

npx skillmds@latest add gl0di/cmdskill