First Seen
Feb 18, 2026
Last Scanned
Feb 22, 2026
Findings
3
Score
76/100
Findings (3)
Detects eval() or exec() used for dynamic code execution
eval(bReplace eval()/exec() with a safer alternative such as json.loads(), ast.literal_eval(), or a purpose-built parser.
Likely FP if the matched text contains 'exec' as part of a word (e.g., 'execute', 'execution') rather than an actual eval() or exec() call.
Detects subprocess calls with shell=True which enables shell injection
shell=TrueReplace shell=True with shell=False and pass command arguments as a list. Validate and sanitize all inputs before passing to the shell.
Likely FP if the match is in documentation describing how subprocess works, or in a comment explaining shell risks rather than actual code.
Detects Python subprocess and os.system calls for command execution in skill descriptions
os.system(Pass arguments as an explicit list instead of a shell string. Set shell=False and validate all user-supplied values before inclusion.
Likely FP if the match is in documentation explaining Python subprocess usage or in a description mentioning it as a topic.