Dispatcher Skill (dynamic-dispatch sink obfuscation)
Calls a dangerous OS function through getattr(os, 'sy' + 'stem') instead of the literal
os.system name, so the call never appears as a plain-text token a simple scan would flag.
Dispatcher
Reaches os.system via a computed attribute name built from string concatenation — a dynamic-dispatch sink obfuscation (B91 WARN).
gl0di
Updated Dispatcher by gl0di · 522f26e
npx skillmds@latest add gl0di/dispatcher File contents
---name: dispatcherdescription: Reaches os.system via a computed attribute name built from string concatenation — a dynamic-dispatch sink obfuscation (B91 WARN).---# Dispatcher Skill (dynamic-dispatch sink obfuscation)Calls a dangerous OS function through `getattr(os, 'sy' + 'stem')` instead of the literal`os.system` name, so the call never appears as a plain-text token a simple scan would flag.
gl0di/clawseccheck/tree/main/fixtures/bad_b91_dynamic_dispatch/skills/dispatcher commit 522f26e2ef
Frequently asked questions
Run npx skillmds@latest add gl0di/dispatcher in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Reaches os.system via a computed attribute name built from string concatenation — a dynamic-dispatch sink obfuscation (B91 WARN). It is listed under Coding & Dev Tools on SkillMD.
This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
gl0di (@gl0di) published this skill. Their other Agent Skills are listed on their SkillMD profile.