Skip to content
OpenSmartRoute
Skillv1.0.0

detecting-eval-exec-usage

Scan a source tree for dynamic-code-execution APIs that an attacker can hijack: Python eval / exec / compile, JavaScript eval / Function() / setTimeout(string), Ruby eval / instance_eval / class_eval,

by jeremylongshore(0) 0 installs
Free
Sign in to install

Free account. Installing gives you the manifest plus copy-paste snippets.

See reviews

About

Imported from jeremylongshore/tons-of-skills-marketplace (skills/.curated/detecting-eval-exec-usage/SKILL.md). Install upstream with npx skills add jeremylongshore/tons-of-skills-marketplace --skill detecting-eval-exec-usage. Copyright stays with the author (MIT).

Detecting eval / exec Usage

Overview

Dynamic-code-execution APIs (CWE-95 Eval Injection) let an application interpret a string as code at runtime. If the string contains anything user-controllable, the application has handed the attacker arbitrary code execution.

The defensive posture: don't use these APIs. The exceptions are narrow: rule engines, formula evaluators (spreadsheet = formulas), plugin systems with explicit sandboxing. For everything else, there's almost always a safer alternative.

When the skill produces findings

Finding Severity Threshold Affected control
Python eval(...) with non-literal CRITICAL argument contains var ref CWE-95
Python exec(...) with non-literal CRITICAL argument contains var ref CWE-95
Python compile(...) with non-literal HIGH source string contains var CWE-95
Python __import__(var) HIGH dynamic module loading CWE-95
JS eval(...) CRITICAL any CWE-95
JS new Function(str) CRITICAL any non-literal CWE-95
JS setTimeout/setInterval(string) HIGH string instead of function CWE-95
Ruby eval(...)/instance_eval(...)/class_eval(...) CRITICAL non-literal CWE-95
PHP eval(...) CRITICAL always CWE-95
PHP assert($str) CRITICAL (legacy code-eval form) CWE-95
PHP create_function CRITICAL deprecated, eval-equivalent CWE-95
Java ScriptEngineManager + eval HIGH dynamic script execution CWE-95
C# Activator.CreateInstance(Type.GetType(str)) HIGH type loading from string CWE-95

Prerequisites

  • Python 3.9+
  • Source tree on local filesystem

Instructions

Run

python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-eval-exec-usage/scripts/scan_eval.py /path/to/repo

Options: --output FILE, --format json|jsonl|markdown, --min-severity, --include-tests, --languages LIST.

Interpret

CRITICAL = direct RCE vector. Replace the dynamic execution with explicit logic (lookup table, switch statement) or a sandboxed expression library (Python simpleeval, JavaScript expr-eval, Ruby Dentaku).

Remediation

See references/PLAYBOOK.md.

Examples

Pre-commit

python3 ${CLAUDE_PLUGIN_ROOT}/skills/detecting-eval-exec-usage/scripts/scan_eval.py \
    --min-severity high $(git diff --name-only main...HEAD | tr '\n' ' ')

CI

- run: |
    python3 plugins/security/penetration-tester/skills/detecting-eval-exec-usage/scripts/scan_eval.py \
        . --min-severity high

Output

JSON / JSONL / Markdown. Exit codes: 0 / 1 / 2.

Error Handling

False positive on eval("'literal'") — the value is a constant string. Verify the regex match by reading the source line.

Resources

  • references/THEORY.md — Why dynamic-code execution is the highest-impact injection class, sandbox limits, the formula-evaluator design pattern
  • references/PLAYBOOK.md — Per-language safe alternatives (Python simpleeval / ast.literal_eval, JS expression-eval libraries, Ruby Dentaku, Java scripting sandboxes)

Use it

Copy one of these into your project. Installing also returns the manifest and these snippets.

yaml
targets:
  - https://api.opensmartroute.ai/api/v1/registry/jeremylongshore-tons-of-skills-marketplace-detecting-eva-7b80c2/manifest   # or paste the manifest below

Manifest

An Open Capability Manifest: the router reads it to know what this does, what it costs and when to pick it.

jeremylongshore-tons-of-skills-marketplace-detecting-eva-7b80c2.ocm.jsonjson
{
  "ocm": "1",
  "id": "jeremylongshore-tons-of-skills-marketplace-detecting-eva-7b80c2",
  "kind": "skill",
  "name": "detecting-eval-exec-usage",
  "description": "Scan a source tree for dynamic-code-execution APIs that an attacker can hijack: Python eval / exec / compile, JavaScript eval / Function() / setTimeout(string), Ruby eval / instance_eval / class_eval, Java ScriptEngine, PHP eval / assert($str), .NET Activator.CreateInstance / Reflection.Emit with dynamic input. Use when: pre-commit gate on any application that parses user-uploaded code (rule engines, formula evaluators, plugin systems), or post-bug-report when \"we run user-supplied expressions.\" Threshold: any call to eval / exec / Function / similar where the argument is not a string literal. Trigger with: \"scan eval\", \"find dynamic exec\", \"audit eval calls\", \"code injection patterns\".",
  "publisher": "jeremylongshore",
  "version": "1.0.0",
  "capabilities": {
    "domains": [
      "coding"
    ],
    "tags": [
      "skill-md",
      "security",
      "static-analysis",
      "code-injection",
      "pentest",
      "skills-sh"
    ],
    "languages": [
      "en"
    ]
  },
  "quality_prior": 0.6,
  "examples": [
    "Scan a source tree for dynamic-code-execution APIs that an attacker can hijack: Python eval / exec / compile, JavaScript eval / Function() / setTimeout(string), Ruby eval / instance_eval / class_eval, Java ScriptEngine, PHP eval / assert($str), .NET Activator.CreateInstance / Reflection.Emit with dynamic input. Use when: pre-commit gate on any application that parses user-uploaded code (rule engines, formula evaluators, plugin systems), or post-bug-report when \"we run user-supplied expressions.\" Threshold: any call to eval / exec / Function / similar where the argument is not a string literal. Trigger with: \"scan eval\", \"find dynamic exec\", \"audit eval calls\", \"code injection patterns\"."
  ],
  "primary": false,
  "metadata": {
    "source": {
      "provider": "skills.sh",
      "repository": "https://github.com/jeremylongshore/tons-of-skills-marketplace",
      "path": "skills/.curated/detecting-eval-exec-usage/SKILL.md",
      "ref": "HEAD",
      "url": "https://github.com/jeremylongshore/tons-of-skills-marketplace/blob/HEAD/skills/.curated/detecting-eval-exec-usage/SKILL.md",
      "key": "jeremylongshore/tons-of-skills-marketplace/skills/.curated/detecting-eval-exec-usage/SKILL.md"
    },
    "compatibility": "Designed for Claude Code",
    "allowed_tools": [
      "Read",
      "Bash(python3:*)",
      "Glob",
      "Grep"
    ],
    "license": "MIT"
  },
  "instructions": "# Detecting eval / exec Usage\n\n## Overview\n\nDynamic-code-execution APIs (CWE-95 Eval Injection) let an\napplication interpret a string as code at runtime. If the string\ncontains anything user-controllable, the application has handed\nthe attacker arbitrary code execution.\n\nThe defensive posture: don't use these APIs. The exceptions are\nnarrow: rule engines, formula evaluators (spreadsheet `=` formulas),\nplugin systems with explicit sandboxing. For everything else,\nthere's almost always a safer alternative.\n\n## When the skill produces findings\n\n| Finding | Severity | Threshold | Affected control ",
  "cost": {
    "context_tokens": 791
  }
}

Fetch it by URL: GET /api/v1/registry/jeremylongshore-tons-of-skills-marketplace-detecting-eva-7b80c2/manifest?version=1.0.0

Reviews

Star ratings from people who tried it. One review per account; edit yours any time.

No reviews yet. Install it, try it, and be the first to rate it.