detecting-command-injection

majiayu000's avatarfrom majiayu000

Detects OS command injection vulnerabilities by identifying unsafe system/popen/exec calls with user-controlled input. Use when analyzing command execution, shell operations, or investigating potential command injection points.

⭐0stars🔀0forks📁View on GitHub🕐Updated Jan 5, 2026
[Security Operations]

When & Why to Use This Skill

This Claude skill automates the detection of OS command injection vulnerabilities by identifying unsafe system calls such as system(), popen(), and exec() paired with user-controlled input. It streamlines the security auditing process by tracing data flow from untrusted sources to sensitive sinks, helping developers and security teams prevent unauthorized command execution and strengthen application defenses.

Use Cases

  • Automated Security Audits: Scan source code during the development lifecycle to identify high-risk command execution points and ensure secure coding practices before deployment.
  • Vulnerability Research: Assist security researchers in tracing data flow from untrusted inputs (APIs, files, or environment variables) to shell execution functions to find exploitable bugs.
  • Code Review Enhancement: Provide real-time security feedback during peer reviews by flagging unvalidated input usage in system-level API calls.
  • Incident Investigation: Analyze existing codebases during a security breach to quickly locate potential entry points for command injection attacks and assess exploitability.
namedetecting-command-injection
descriptionDetects OS command injection vulnerabilities by identifying unsafe system/popen/exec calls with user-controlled input. Use when analyzing command execution, shell operations, or investigating potential command injection points.

Command Injection Detection

Detection Workflow

  1. Identify command execution points: Find system(), popen(), execve(), ShellExecute(), CreateProcess() calls
  2. Trace input sources: Use xrefs_to to trace command strings to user input (network, files, environment variables)
  3. Check sanitization: Verify input validation, character escaping, command argument separation, safe API usage
  4. Assess exploitability: Can attacker inject special characters (;, &, |, `)? Control command arguments? Execute multiple commands?

Key Patterns

  • Direct system() with unvalidated user input
  • popen() with partial sanitization
  • execve with insufficient validation
  • Indirect command execution via environment variables

Output Format

Report with: id, type (system/popen/exec), severity, confidence, location, sink, source, command string, sanitization status, exploitability, payload example, mitigation.

Severity Guidelines

  • CRITICAL: Direct use of system() with unvalidated user input
  • HIGH: popen() with partial sanitization
  • MEDIUM: execve with array but insufficient validation
  • LOW: Command execution with strict whitelisting

See Also

  • patterns.md - Detailed detection patterns and exploitation scenarios
  • examples.md - Example analysis cases and code samples
  • references.md - CWE references and mitigation strategies