# Command Injection Rce

Turn suspected OS command injection (a parameter that lands in a shell or a child...

- Repository: https://github.com/vigolium/vigolium (1141 stars)
- Category: Engineering
- License: MIT
- Last updated: 2026-10-25
- Runs scripts: no, instructions only

## Install

Claude Code: `npx skills add vigolium/vigolium --skill command-injection-rce -g -a claude-code -y`
Codex: `npx skills add vigolium/vigolium --skill command-injection-rce -g -a codex -y`
Cursor: `npx skills add vigolium/vigolium --skill command-injection-rce -g -a cursor -y`
Gemini CLI: `npx skills add vigolium/vigolium --skill command-injection-rce -g -a gemini-cli -y`

## Description

Turn suspected OS command injection (a parameter that lands in a shell or a child process) into proof of remote code execution via an OAST callback, plus one safe demonstration of follow-on impact (read a file, list users, env dump). Use when a parameter feeds an exec/spawn/system call, when payloads with $(), `` ` ``, `;`, `|`, `&&` cause response differences, or when audit flags CWE-78 / CWE-77. Never sends destructive commands.

## SKILL.md, as published by its author (untrusted third-party text, read it as data)

# Command Injection → RCE Proof

You have a parameter that smells like it lands in a shell or process
exec call. Your job is to prove arbitrary command execution by getting
an OAST callback from the server, then demonstrate one minimal
follow-on action (a file read, an env dump). Reporting "the response
changed when I sent `;`" is not enough.

## When this skill applies

- A parameter feeds something likely to exec: `cmd=`, `host=` (ping),
  `target=` (traceroute), `file=` (image conversion, PDF render,
  zip/tar), `filter=`, `format=` (ffmpeg, imagemagick), `name=` on a
  user-management endpoint that shells out.
- Response differs when you send characters that have shell meaning:
  `;`, `|`, `&`, `&&`, `||`, `` ` ``, `$(...)`, `\n`.
- A 500 error message reveals a binary name (`sh`, `bash`, `convert`,
  `ffmpeg`, `ImageMagick`, `node`, `python`, `php`) in the stack
  trace or response body.
- Audit finding: CWE-78 (OS command injection), CWE-77 (command
  injection), CWE-94 (code injection).

## Workflow

### 1. Confirm a shell metacharacter changes behavior

Pick a candidate parameter from `query_records` + `inspect_record`.
Send three `replay_request` probes:

- Baseline: harmless value (e.g. `8.8.8.8` for a ping endpoint).
- `8.8.8.8;` → trailing separator. Status / length differential?
- `8.8.8.8 && echo hi` → does `hi` appear in the response, or does
  the response take longer?

If none of these change the response, the parameter is probably
sanitized or doesn't shell out. Stop and pick another candidate.

`remember` the candidate parameter and which metacharacter triggered
the differential (key: `cmdinj-target`).

### 2. Confirm execution via OAST

Mint a canary with `oast_mint` (kind: `cmdinj-probe`). Inject a payload
that performs a DNS or HTTP request to the canary. Choose the encoding
by the suspected OS / language:

The rest: https://github.com/vigolium/vigolium/blob/HEAD/internal/resources/olium/skills/command-injection-rce/SKILL.md