zakirkun Command Injection
Overview
Detects untrusted input passed directly to operating system shell commands.
Remediation
Avoid calling OS commands directly. Use built-in language APIs. If necessary, use exec arrays instead of shell strings.
Command Injection
Detects untrusted input passed directly to operating system shell commands.
Command Injection by zakirkun · 63c9a6c
npx skillmds@latest add zakirkun/command-injection File contents
---name: command-injectiondescription: Detects untrusted input passed directly to operating system shell commands.---# Command Injection## OverviewDetects untrusted input passed directly to operating system shell commands.## RemediationAvoid calling OS commands directly. Use built-in language APIs. If necessary, use exec arrays instead of shell strings.
zakirkun/ice-tea/tree/main/skills/web/command-injection commit 63c9a6c7cf
Frequently asked questions
Run npx skillmds@latest add zakirkun/command-injection in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.
Detects untrusted input passed directly to operating system shell commands. It is listed under Coding & Dev Tools on SkillMD.
This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.
This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.
Yes. Installing skills from SkillMD is free, and the skill stays under its author's original license.
zakirkun (@zakirkun) published this skill. Their other Agent Skills are listed on their SkillMD profile.