Will It Vibe?exec.Command shell invocation built with string concatenation
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
exec.Command("sh", "-c", ...) (or bash/zsh/dash/ksh) runs its script argument through a shell, and here that argument is assembled with + string concatenation, so a variable that reaches it can inject additional shell commands.
Why it matters
exec.Command("sh", "-c", script) hands the whole script string to a shell, which interprets metacharacters like ;, |, &&, and backticks. When that script is assembled by concatenating a variable into it, anything the variable contains that a shell treats specially becomes part of the command, not just data. That is a direct path from an untrusted string to arbitrary command execution on the host.
How to fix it
Avoid the shell entirely: call exec.Command with the real program and its arguments as separate strings (exec.Command("cp", src, dst)) so the OS executes it directly with no shell parsing. If you genuinely need shell features (pipes, globbing), keep the script text a fixed literal and pass the untrusted value as an environment variable or a positional argument to the script instead of splicing it into the script source.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo