Command Injection Rce
Turn suspected OS command injection (a parameter that lands in a shell or a child...
Install
npx skills add vigolium/vigolium --skill command-injection-rce -g -a claude-code -y- Repository
- vigolium/vigolium1.1k
- Category
- Engineering
- Updated
- 10d ago
- License
- MIT
- Context cost
- Lightabout 1,279 tokens
- Runs scripts
- No, instructions only
What it does
Turn suspected OS command injection (a parameter that lands in a shell or a child process) into proof of remote code execution via an OAST callback, plus one safe demonstration of follow-on impact (read a file, list users, env dump). Use when a parameter feeds an exec/spawn/system call, when payloads with $(), `` ` ``, `;`, `|`, `&&` cause response differences, or when audit flags CWE-78 / CWE-77. Never sends destructive commands.
Command Injection → RCE Proof
You have a parameter that smells like it lands in a shell or process
exec call. Your job is to prove arbitrary command execution by getting
an OAST callback from the server, then demonstrate one minimal
follow-on action (a file read, an env dump). Reporting "the response
changed when I sent ;" is not enough.
When this skill applies
- A parameter feeds something likely to exec:
cmd=,host=(ping),target=(traceroute),file=(image conversion, PDF render, zip/tar),filter=,format=(ffmpeg, imagemagick),name=on a user-management endpoint that shells out. - Response differs when you send characters that have shell meaning:
;,|,&,&&,||,`,$(...),\n. - A 500 error message reveals a binary name (
sh,bash,convert,ffmpeg,ImageMagick,node,python,php) in the stack trace or response body. - Audit finding: CWE-78 (OS command injection), CWE-77 (command injection), CWE-94 (code injection).
Workflow
1. Confirm a shell metacharacter changes behavior
Pick a candidate parameter from query_records + inspect_record.
Send three replay_request probes:
- Baseline: harmless value (e.g.
8.8.8.8for a ping endpoint). 8.8.8.8;→ trailing separator. Status / length differential?8.8.8.8 && echo hi→ doeshiappear in the response, or does the response take longer?
If none of these change the response, the parameter is probably sanitized or doesn't shell out. Stop and pick another candidate.
remember the candidate parameter and which metacharacter triggered
the differential (key: cmdinj-target).
2. Confirm execution via OAST
Mint a canary with oast_mint (kind: cmdinj-probe). Inject a payload
that performs a DNS or HTTP request to the canary. Choose the encoding
by the suspected OS / language:
