Skip to main content

sast-rce

Detects Remote Code Execution vulnerabilities in codebases using a structured three-phase approach for security assessments.

Install this skill

or
0/100

Security score

The sast-rce skill was audited on Jun 13, 2026 and we found 73 security issues across 5 threat categories, including 19 critical. Review the findings below before installing.

Categories Tested

Security Issues

critical line 34

Direct command execution function call

SourceSKILL.md
34- Using `eval()`, `exec()`, `Function()`, or equivalent constructs with user-controlled strings
high line 63

Direct command execution function call

SourceSKILL.md
63child_process.spawn("ffmpeg", ["-i", inputFile, outputFile])
high line 98

Direct command execution function call

SourceSKILL.md
98spawn(cmd, []);
high line 135

Direct command execution function call

SourceSKILL.md
135exec(`grep -r "${query}" /var/log/app/`, (err, stdout) => {
high line 143

Direct command execution function call

SourceSKILL.md
143return execSync('node scripts/' + userScript);
high line 149

Direct command execution function call

SourceSKILL.md
149const proc = spawn('grep', ['-r', query, '/var/log/app/']);
high line 216

Direct command execution function call

SourceSKILL.md
216exec(code) # full arbitrary code execution
critical line 401

Direct command execution function call

SourceSKILL.md
401> - `child_process.exec(var)`, `child_process.execSync(var)` — flag if any variable in command string
critical line 403

Direct command execution function call

SourceSKILL.md
403> - `child_process.spawn(var, ...)` or `spawn(cmd, args)` with `shell: true` and variable in command — flag
critical line 404

Direct command execution function call

SourceSKILL.md
404> - `shelljs.exec(var)`, `execa(var)` — flag if variable in command
critical line 407

Direct command execution function call

SourceSKILL.md
407> - `exec(var)`, `system(var)`, `passthru(var)`, `shell_exec(var)`, `popen(var, ...)`, `proc_open(var, ...)` — flag if any variable in command string
critical line 411

Direct command execution function call

SourceSKILL.md
411> - `system(var)`, `exec(var)`, `spawn(var)`, `IO.popen(var)`, `Open3.popen3(var)` — flag if string form with interpolated variable
critical line 416

Direct command execution function call

SourceSKILL.md
416> - `Runtime.getRuntime().exec(var)` — flag if string argument contains variable concatenation
critical line 434

Direct command execution function call

SourceSKILL.md
434> - `exec(var)` — flag if argument is a variable
critical line 435

Direct command execution function call

SourceSKILL.md
435> - `compile(var, ...)` followed by `exec()` — flag
critical line 707

Direct command execution function call

SourceSKILL.md
707- **For OS command sinks**: `subprocess.run(["cmd", var])` with list form and no `shell=True` is NOT command injection — the argument is passed directly to the process without shell interpretation. On
critical line 34

Eval function call - arbitrary code execution

SourceSKILL.md
34- Using `eval()`, `exec()`, `Function()`, or equivalent constructs with user-controlled strings
high line 209

Eval function call - arbitrary code execution

SourceSKILL.md
209result = eval(expr) # attacker can run __import__('os').system('id')
high line 234

Eval function call - arbitrary code execution

SourceSKILL.md
234const result = eval(formula); // RCE: process.exit(), require('child_process')...
critical line 433

Eval function call - arbitrary code execution

SourceSKILL.md
433> - `eval(var)` — flag if argument is a variable
critical line 439

Eval function call - arbitrary code execution

SourceSKILL.md
439> - `eval(var)` — flag if argument is a variable
critical line 446

Eval function call - arbitrary code execution

SourceSKILL.md
446> - `eval(var)` — always flag if variable in argument
critical line 453

Eval function call - arbitrary code execution

SourceSKILL.md
453> - `eval(var)`, `instance_eval(var)`, `class_eval(var)`, `module_eval(var)` — flag if variable
critical line 454

Eval function call - arbitrary code execution

SourceSKILL.md
454> - `binding.eval(var)` — flag if variable
critical line 708

Eval function call - arbitrary code execution

SourceSKILL.md
708- **For `eval`-like sinks**: there is almost no safe way to use `eval()` with user input. Any eval-like sink receiving external data should be flagged Vulnerable.
critical line 711

Eval function call - arbitrary code execution

SourceSKILL.md
711- Second-order RCE is possible: a value stored from user input may later be deserialized or evaluated in a different code path (e.g., a user-supplied config stored in DB and later `eval()`'d by a cron
medium line 135

Template literal with variable interpolation in command context

SourceSKILL.md
135exec(`grep -r "${query}" /var/log/app/`, (err, stdout) => {
medium line 240

Template literal with variable interpolation in command context

SourceSKILL.md
240const fn = new Function('x', `return ${userExpression}`);
medium line 68

System command execution

SourceSKILL.md
68# Ruby — system() with multiple args (not a single interpolated string)
medium line 69

System command execution

SourceSKILL.md
69system("ffmpeg", "-i", "input.mp4", "-f", format, "output")
medium line 119

System command execution

SourceSKILL.md
119os.system(f"convert {filename} -resize {size} output.jpg")
medium line 182

System command execution

SourceSKILL.md
182# VULNERABLE: string interpolation in system()
medium line 185

System command execution

SourceSKILL.md
185system("ffmpeg -i input.mp4 -f #{format} output")
medium line 193

System command execution

SourceSKILL.md
193# SECURE: system() with separate args (no shell expansion)
medium line 198

System command execution

SourceSKILL.md
198system("ffmpeg", "-i", "input.mp4", "-f", format, "output")
medium line 209

System command execution

SourceSKILL.md
209result = eval(expr) # attacker can run __import__('os').system('id')
high line 394

System command execution

SourceSKILL.md
394> - `os.system(var)` — always flag if any variable
high line 407

System command execution

SourceSKILL.md
407> - `exec(var)`, `system(var)`, `passthru(var)`, `shell_exec(var)`, `popen(var, ...)`, `proc_open(var, ...)` — flag if any variable in command string
high line 411

System command execution

SourceSKILL.md
411> - `system(var)`, `exec(var)`, `spawn(var)`, `IO.popen(var)`, `Open3.popen3(var)` — flag if string form with interpolated variable
high line 707

System command execution

SourceSKILL.md
707- **For OS command sinks**: `subprocess.run(["cmd", var])` with list form and no `shell=True` is NOT command injection — the argument is passed directly to the process without shell interpretation. On
low line 63

Node child_process module reference

SourceSKILL.md
63child_process.spawn("ffmpeg", ["-i", inputFile, outputFile])
low line 234

Node child_process module reference

SourceSKILL.md
234const result = eval(formula); // RCE: process.exit(), require('child_process')...
medium line 401

Node child_process module reference

SourceSKILL.md
401> - `child_process.exec(var)`, `child_process.execSync(var)` — flag if any variable in command string
medium line 402

Node child_process module reference

SourceSKILL.md
402> - `child_process.execFile(var, ...)` — flag if command or args contain variables
medium line 403

Node child_process module reference

SourceSKILL.md
403> - `child_process.spawn(var, ...)` or `spawn(cmd, args)` with `shell: true` and variable in command — flag
medium line 119

Python os.system command execution

SourceSKILL.md
119os.system(f"convert {filename} -resize {size} output.jpg")
high line 394

Python os.system command execution

SourceSKILL.md
394> - `os.system(var)` — always flag if any variable
high line 49

Python subprocess execution

SourceSKILL.md
49- **Safe subprocess list-form calls**: `subprocess.run(["ls", user_arg])` with a list and no `shell=True` — arguments are passed directly to the OS without shell expansion; not vulnerable to command i
medium line 59

Python subprocess execution

SourceSKILL.md
59subprocess.run(["convert", "-resize", size, input_file, output_file])
medium line 60

Python subprocess execution

SourceSKILL.md
60subprocess.Popen(["git", "clone", repo_url])
medium line 93

Python subprocess execution

SourceSKILL.md
93subprocess.run(["convert", infile, f"output.{fmt}"])
medium line 112

Python subprocess execution

SourceSKILL.md
112result = subprocess.run(f"ping -c 1 {host}", shell=True, capture_output=True, text=True)
medium line 125

Python subprocess execution

SourceSKILL.md
125result = subprocess.run(["ping", "-c", "1", host], capture_output=True, text=True, timeout=5)
high line 396

Python subprocess execution

SourceSKILL.md
396> - `subprocess.run(var, shell=True)`, `subprocess.call(var, shell=True)`, `subprocess.Popen(var, shell=True)`, `subprocess.check_output(var, shell=True)` — flag if `shell=True` AND a variable appears
high line 397

Python subprocess execution

SourceSKILL.md
397> - `subprocess.run(f"cmd {var}")` without `shell=True` — flag: passing a string (not list) to subprocess can still be unsafe
high line 497

Python subprocess execution

SourceSKILL.md
497> - `subprocess.run(["cmd", arg1, arg2])` with a list and no `shell=True` — no shell expansion
high line 518

Python subprocess execution

SourceSKILL.md
518> - **Sink**: [the dangerous function call — e.g., subprocess.run(..., shell=True)]
high line 573

Python subprocess execution

SourceSKILL.md
573> 1. **Subprocess list form without shell**: `subprocess.run(["cmd", var])` without `shell=True` — no shell metacharacter injection.
high line 605

Python subprocess execution

SourceSKILL.md
605> - **Subprocess list form**: `subprocess.run(["cmd", var])` without `shell=True` — arguments are passed directly to the OS, no shell expansion. This IS an effective mitigation for command injection (
high line 626

Python subprocess execution

SourceSKILL.md
626> - **Taint trace**: [Step-by-step from entry point to the sink — e.g., "request.args.get('host') → host → subprocess.run(f'ping -c 1 {host}', shell=True)"]
high line 707

Python subprocess execution

SourceSKILL.md
707- **For OS command sinks**: `subprocess.run(["cmd", var])` with list form and no `shell=True` is NOT command injection — the argument is passed directly to the process without shell interpretation. On
high line 634

Curl to non-GitHub URL

SourceSKILL.md
634> curl "https://app.example.com/ping?host=127.0.0.1;id"
high line 635

Curl to non-GitHub URL

SourceSKILL.md
635> curl "https://app.example.com/ping?host=127.0.0.1%3Bid"
high line 139

Access to /etc/passwd

SourceSKILL.md
139// Payload: ?q=foo" /etc/passwd "
critical line 627

Access to /etc/passwd

SourceSKILL.md
627> - **Impact**: [What an attacker can do — execute arbitrary OS commands, read /etc/passwd, establish reverse shell, achieve full server compromise, etc.]
low line 273

Base64 decode operation

SourceSKILL.md
273data = base64.b64decode(session_cookie)
low line 281

Base64 decode operation

SourceSKILL.md
281user = json.loads(base64.b64decode(session_cookie))
low line 311

Base64 decode operation

SourceSKILL.md
311$data = base64_decode($_COOKIE['profile']);
low line 321

Base64 decode operation

SourceSKILL.md
321$data = base64_decode($_COOKIE['profile']);
low line 332

Base64 decode operation

SourceSKILL.md
332data = Base64.decode64(params[:state])
low line 339

Base64 decode operation

SourceSKILL.md
339data = JSON.parse(Base64.decode64(params[:state]))
low line 634

External URL reference

SourceSKILL.md
634> curl "https://app.example.com/ping?host=127.0.0.1;id"
low line 635

External URL reference

SourceSKILL.md
635> curl "https://app.example.com/ping?host=127.0.0.1%3Bid"
Scanned on Jun 13, 2026
View Security Dashboard
Installation guide →
GitHub Stars 661
Rate this skill
Categorydevelopment
UpdatedJune 15, 2026
openclawbackendsecurity-engineerbackend-developerdevops-sredevelopment
utkusen/sast-skills