The Agent Skills Directory

[COMMAND_EXECUTION]: The script scripts/check_phase.py uses subprocess.run() with shell=True to execute input received from command-line arguments.
Evidence: In scripts/check_phase.py, the variable test_command is constructed from sys.argv[1:] and passed directly to subprocess.run(test_command, shell=True, capture_output=True, text=True).
Risk: This allows for arbitrary shell command execution. An attacker could potentially use shell metacharacters (e.g., ;, &&, |) in the input to execute unintended system commands.

tdd-cycle-manager