Detect Remote Code Execution (RCE) vulnerabilities in a codebase using a three-phase approach: recon (find dangerous execution sinks), batched verify (trace user input to sinks in parallel subagents, 3 sinks each), and merge (consolidate batch results). Covers OS command injection, eval-like sinks, and unsafe deserialization. Requires sast/architecture.md (run sast-analysis first). Outputs findings to sast/rce-results.md.
NewMaintained
Automatic
◆Security & AppSec pack
Last verified 8/14/2026
What it changes
Passed 11 of 21 test cases with the skill, and 11 of 21 without it.
Without skill50%
With skill50%
Checks it passed that the model alone missed
Writes 'No vulnerabilities found.' to sast/rce-results.md.
Groups the 8 sinks into 3 parallel batches containing at most 3 sinks each.
Classifies escapeshellarg usage on command string arguments as Likely Vulnerable.
and 1 more in the full report
4 fixed11 passed either way4 still failing3 broke
Pass-rate lift
0 pp
Tokens
+513%
Agent turns
0%
Response time
-19%
Model gemini-3.6-flashMeasured 8/14/2026v115 of 22 cases passed with skill · 21 comparable
Tokens, turns and time describe resource use, not a dollar price.
See it in action
One of 4 test cases the skill fixed. Same model, same prompt, with and without the skill.
1 of 4
Prompt
In our PHP script, user input passes through `escapeshellarg($_GET['size'])` before being passed into `shell_exec("convert image.jpg -resize " . $size . " output.jpg")`. Is this considered completely immune to command injection or should it carry a specific finding status?
What was checked, without and with the skill
Checked
Without skill
With skill
Classifies escapeshellarg usage on command string arguments as Likely Vulnerable.
Missed
Passed
case-13 · gemini-3.6-flash · 8/14/2026 · answers are capped and redacted
What's inside
The instructions your model reads when the skill loads.
SKILL.md701 linessingle file
Remote Code Execution (RCE) Detection
You are performing a focused security assessment to find Remote Code Execution vulnerabilities in a codebase. This skill uses a three-phase approach with subagents: recon (find dangerous execution sinks), batched verify (trace whether user-supplied input reaches each sink in parallel batches of 3), and merge (consolidate batch results into the final report).
Prerequisites: sast/architecture.md must exist. Run the analysis skill first if it doesn't.
What is Remote Code Execution
Remote Code Execution (RCE) occurs when an attacker can cause the application to execute arbitrary OS commands or application-level code that they control. This is typically the highest-severity vulnerability class, often resulting in complete server compromise.
RCE arises from three primary root causes:
OS Command Injection: User input is embedded unsafely into an OS command string, allowing shell metacharacters to inject additional commands.
Code Injection (eval-like): User input is passed to functions that interpret it as executable code (eval, exec, Function(), etc.).
Unsafe Deserialization: User-supplied serialized data is deserialized using a gadget-prone deserializer, triggering arbitrary code execution via crafted payloads.
What RCE IS
Passing user input directly or indirectly into OS command execution functions with shell interpretation enabled
Using eval(), exec(), Function(), or equivalent constructs with user-controlled strings
Using yaml.load() without a safe loader on user-supplied content
Dynamic require()/import() with user-controlled module paths
PHP file inclusion (include/require) with user-controlled paths
What RCE is NOT
Do not flag these as RCE:
SSRF: Making HTTP requests to attacker-controlled URLs — different vulnerability class (no code execution)
Path Traversal: Reading/writing arbitrary files — separate class (unless the read file is then executed/deserialized)
SSTI: Template injection via template engines — a separate though related class; flag as SSTI, not RCE
XSS: JavaScript execution in a victim's browser — client-side only, not server-side RCE
SQL Injection: Injecting into database queries — different class (even if xp_cmdshell can lead to OS commands, flag it as SQLi)
Safe subprocess list-form calls: subprocess.run(["ls", user_arg]) with a list and no shell=True — arguments are passed directly to the OS without shell expansion; not vulnerable to command injection
Safe deserialization: json.loads(), yaml.safe_load(), xml.etree.ElementTree.parse() — these formats have no code execution semantics