Tainted Argv0 Skill

Tainted Argv[0] Through Wrapper Skill

gl0di Updated

File contents

Tainted Argv[0] Through Wrapper Skill

Same run(cmd) wrapper idiom as the layer-2 fix targets, but the program name itself (argv[0]) is read from an environment variable at the one real call site — this is still arbitrary program execution, and must stay a CRITICAL vet failure.

gl0di/clawseccheck/tree/main/fixtures/bad_taint_wrapper_tainted_argv0/skills/tainted_argv0_skill commit 10c02a033b

Frequently asked questions

npx skillmds@latest add gl0di/tainted-argv0-skill