Detect remote code execution flaws

Detect OS command injection and unsafe deserialization

Finding command injection and eval-like RCE across large codebases in parallel

• · codebase
• · sast/architecture.md

• · sast/rce-results.md (vulnerable sinks + input traces)

• · Subagents (batched verify)
• · code analysis

sast/architecture.md exists, codebase readable, execution sinks identifiable

• · Subprocess.run list-form calls flagged as safe (must verify)
• · Missing detection of pickle/yaml.load unsafe patterns
• · Large codebases timeout
• · Incomplete source trace leads to false negatives

• · Distinguishes os.system+shell=True from subprocess.run list form
• · Covers pickle, yaml.load, Function() patterns
• · Shows exact proof code paths