Will It Vibe?subprocess called with shell=True (Python)
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 4 points from that category, once per scan, no matter how many places it turns up.
What it detects
Passing shell=True to subprocess runs the argument through /bin/sh. This is a command injection risk if any part of the command is dynamic. Heuristic: it also flags static commands.
Why it matters
shell=True makes subprocess run the whole command through /bin/sh, so any dynamic part can inject extra commands. This is a heuristic: it also flags fully static commands, which are lower risk, so treat it as a prompt to confirm nothing dynamic reaches the shell.
How to fix it
Drop shell=True and pass the command as an argument list: subprocess.run(["grep", pattern, "file.txt"]). If you rely on shell features like pipes, either build the pipeline with multiple subprocess calls or validate the dynamic parts against an allowlist.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo