Will It Vibe?exec.Command invoking a shell with -c (Go)
Part of Security, which counts for 30% of the overall score. When this check fires it deducts 8 points from that category, once per scan, no matter how many places it turns up.
What it detects
exec.Command("sh", "-c", ...) (or bash/cmd) runs its argument through a shell, so any dynamic part becomes command injection. Prefer passing argv directly with no shell.
Why it matters
exec.Command("sh", "-c", cmd) runs its argument through a shell, so any dynamic part of cmd can inject additional commands. Go normally avoids this because exec.Command passes argv directly. It is a heuristic because the command string may be fully static.
How to fix it
Call exec.Command with the program and its arguments as separate parameters and no shell: exec.Command("ping", "-c", "1", host). Drop the sh -c wrapper. If you need shell features, validate the dynamic parts against a strict allowlist first.
The paid report includes a ready-to-paste prompt for your AI coding agent for every check it finds, pointed at the exact findings from your scan. See pricing
Does your repo trip this check?
Paste a GitHub URL or drop a project folder. Scans run in your browser and take seconds.
Scan your repo