Detect OS command injection vulnerabilities across multiple programming languages.
npx skills add https://github.com/ersinkoc/security-check --skill sc-cmdi
Please help me install this Agent Skill. Skill: sc-cmdi Source: https://github.com/ersinkoc/security-check/tree/main/skills/sc-cmdi Command: npx skills add https://github.com/ersinkoc/security-check --skill sc-cmdi
OS command injection occurs when user-supplied input is passed to shell commands, subprocess calls, or process spawning without proper sanitization. This Skill detects such vulnerabilities across multiple language environments by tracing dangerous patterns from input sources to execution sinks and distinguishing between full command injection and argument injection.
Run sc-cmdi against your codebase to identify and classify OS command injection risks in shell and subprocess calls.
High-intent search queries and answers about installing and using this skill.
Detect OS command injection by tracing data flow from user input sources to shell execution sinks. This skill analyzes subprocess calls and process spawning patterns across multiple languages, classifying risks from argument injection to full command injection.
Argument injection occurs when user input appends unsanitized parameters to a fixed command, while full command injection allows arbitrary shell execution. This skill traces data flow from sources to sinks to differentiate both vulnerability types and assign severity.
Yes, command injection detection applies across Python, JavaScript, Node.js, Go, PHP, Java, C#, and Ruby. The static analysis identifies dangerous patterns from user input to process spawning sinks in all these language environments.
Scan for shell execution vulnerabilities by running the analysis against your codebase to discover risky patterns. It identifies dangerous process spawning and subprocess calls in Node.js and Ruby by tracing user input data flow to execution sinks.
Find user input reaching shell commands by applying static analysis with data-flow tracing from sources to execution sinks. This approach discovers risky patterns in C# and Java subprocess calls and generates structured findings with severity classifications.
Yes, this security analysis tool operates without external dependencies. It directly analyzes your source code to identify risky process spawning and subprocess calls, generating structured findings with severity classifications for remediation guidance.
uukuguyCalculate complexity, size, coupling, and duplication metrics from source code.
alxayoScan shell scripts for security issues using ShellCheck static analysis.
Endor-Solutions-ArchitectureRun static application security testing to detect code-level vulnerabilities in a repository.
AnsteorraPerform static and dynamic security audits on the KMP application.
