# Aibugs

> Find bugs and vulnerabilities in C code for radare2

- Skill: `netvar1337/aibugs` (Agent Skill, multi-file: 2 files)
- Install (CLI): `npx skillmds@latest add netvar1337/aibugs`
- Raw SKILL.md: https://api.skillmd.com/api/skills/netvar1337/aibugs/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: netvar1337 (https://skillmd.com/u/netvar1337)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/netvar1337/aibugs

---


## Introduction

There are several classic vulnerabilities misusing libc apis or just plain C. But you are an expert in radare2, so you must focus on understanding missuses of the libr apis and scripts instead.

## Steps

1. Read AGENTS.md, follow the rules
  - Patches must be surgical, small, refactor to avoid duplicating code, keep logic simple.
2. Find command injection vulnerabilities
  - The `r_core_cmd` apis parse special characters, which if the user or the binary loaded have control
  - Better use `r_core_call` functions
  - Prefer the use of `call_at` if a temporal seek is needed
3. Autogenerated scripts
   - The `*` command suffix, will force the output to contain a script for radare2.
   - Read the `r_cons_printf` calls used in those subcommands to find out any

It's recommended, to run r2 oneliners to confirm the vulnerabilities are real before fixing them.

The single quote commands syntax permits temporal seeks too, for example this command is the safe equivocalent of `x@0x123`. Also, an important hint for single quote commands

```radare2
'@0x123'x
```

The double quote commands are also vulnerable to command injection if data is not filtered properly for example:

```radare2
"echo hello";"echo "world"
```

In the code above, if `hello` was controlled by the user they can include a quote to close the command and inject a semicolon to run a separate command.

## Command syntax:

When running a command that starts with "'", the command parser will ignore all the special characters and just run the command with given arguments.
- if the command is a system shell escape `!` there can be still code injection bugs, see the sanitize for `sh` in this case

## Shell injection bugs

* See `r_str_sanitize_sh` and the `r_sys_cmd` apis
* Ensure all this follows the right strict rules from the `r_sandbox` settings

## Sanitization APIs:

See `r_name_filter`, and all the `r_str_sanitize` apis to understand their purpose and use them wisely, do not reduce the.

Some commands accept `base64:` arguments. Use them if we really need raw data accepting any characters.