Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →jeremylongshore/detecting-eval-exec-usage
Scan a source tree for dynamic-code-execution APIs that an attacker can hijack: Python eval / exec / compile, JavaScript eval / Function() / setTimeout(string), Ruby eval / instance_eval / class_eval, Java ScriptEngine, PHP eval / assert($str), .NET Activator.CreateInstance / Reflection.Emit with dynamic input.
Passed 19 of 22 test cases with the skill, and 13 of 22 without it.
and 4 more in the full report
7 fixed14 passed either way3 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 7 test cases the skill fixed. Same model, same prompt, with and without the skill.
How do you run a command-line scan across `./src` that filters out warnings below HIGH severity?
| Checked | Without skill | With skill |
|---|---|---|
| Uses the --min-severity high flag with scan_eval.py | Missed | Passed |
The instructions your model reads when the skill loads.
Dynamic-code-execution APIs (CWE-95 Eval Injection) let an application interpret a string as code at runtime. If the string contains anything user-controllable, the application has handed the attacker arbitrary code execution.
The defensive posture: don't use these APIs. The exceptions are
narrow: rule engines, formula evaluators (spreadsheet = formulas),
plugin systems with explicit sandboxing. For everything else,
there's almost always a safer alternative.
| Finding | Severity | Threshold | Affected control |
|---|---|---|---|
Python eval(...) with non-literal | CRITICAL | argument contains var ref | CWE-95 |
Python exec(...) with non-literal | CRITICAL | argument contains var ref | CWE-95 |
Python compile(...) with non-literal | HIGH | source string contains var | CWE-95 |
Python __import__(var) | HIGH | dynamic module loading | CWE-95 |
JS eval(...) | CRITICAL | any | CWE-95 |
JS new Function(str) | CRITICAL | any non-literal | CWE-95 |
JS setTimeout/setInterval(string) | HIGH | string instead of function | CWE-95 |
Ruby eval(...)/instance_eval(...)/class_eval(...) | CRITICAL | non-literal | CWE-95 |
PHP eval(...) | CRITICAL | always | CWE-95 |
PHP assert($str) | CRITICAL | (legacy code-eval form) | CWE-95 |
PHP create_function | CRITICAL | deprecated, eval-equivalent | CWE-95 |
Java ScriptEngineManager + eval | HIGH | dynamic script execution | CWE-95 |
C# Activator.CreateInstance(Type.GetType(str)) | HIGH | type loading from string | CWE-95 |
test cases passed, vs 13 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.