Group
  • Security

    Prevent command injection in shell calls

    Finds every place user input reaches a shell command and replaces string interpolation with safe argument arrays.

    • Improve quality
    • Debug & fix
    • Advanced
    • General

Free Prompt

Audit my app for command injection risks. Find every place the server executes a shell command or spawns a process, and check whether any part of the command comes from user input (filenames, URLs, search terms, export formats, image processing parameters). For each risky call: stop building command strings with interpolation; use the spawn/execFile-style APIs that take the program and arguments as an array, so arguments can't break out into new commands or flags. Where a shell is genuinely required, validate input against a strict allowlist (for example, a filename matching only [a-zA-Z0-9._-]) and reject everything else. Check for argument-injection too: a value starting with - can be interpreted as a flag (a filename of --output=/etc/cron.d/x is not just a filename), so use -- separators where the tool supports them. Do not remove functionality; the features should keep working with safe inputs. If a library offers the same operation natively (image resizing, PDF generation), prefer the library over shelling out. List each process-execution point, the input that reached it, and the fix. Give me test cases: a filename containing ; rm -rf style shell metacharacters and a value starting with --, both confirmed neutralized, plus a legitimate case that still works.

What This Does / How This Helps

Finds where user input flows into shell commands and rebuilds those calls so input can never become part of the command itself. Command injection is the worst-case bug class: the attacker runs whatever they want on your server with your app's permissions. It sneaks in through innocent features like PDF exports, image conversions, or git operations, anywhere a filename or option from the user gets glued into a command string. The fixes are mechanical once found (argument arrays instead of strings, strict allowlists, flag separators), and the test cases include the classic metacharacter payload so you can watch it do nothing.

Want to skip doing this by hand?

Fortivibe audits your app for all of the areas these prompts cover (and more).

See What We Check

Related Prompts