security-checker

clawhub:security-checker

View source
B
84/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

2

Score

84/100

MEDIUM 2

Findings (2)

MEDIUM
Python subprocess execution
L42

Detects Python subprocess and os.system calls for command execution in skill descriptions

os.system(
FIX

Pass arguments as an explicit list instead of a shell string. Set shell=False and validate all user-supplied values before inclusion.

FP?

Likely FP if the match is in documentation explaining Python subprocess usage or in a description mentioning it as a topic.

MEDIUM
Python subprocess execution
L43

Detects Python subprocess and os.system calls for command execution in skill descriptions

subprocess.call(
FIX

Pass arguments as an explicit list instead of a shell string. Set shell=False and validate all user-supplied values before inclusion.

FP?

Likely FP if the match is in documentation explaining Python subprocess usage or in a description mentioning it as a topic.