From 85a63471a2b4c6e5222620877055b59bac5bb422 Mon Sep 17 00:00:00 2001
From: Chris Brown <257249062+albatrossflyon-coder@users.noreply.github.com>
Date: Tue, 21 Jul 2026 11:26:42 -0500
Subject: [PATCH] fix: sanitize os.system() shell injection in manimgl scene
 templates

os.system(f"manimgl {__file__} ClassName") interpolates the script's own
path into a shell string. These templates are meant to be copied and
renamed per-scene by an agent, so a scene/folder name containing shell
metacharacters is a real injection path, not just malformed input.

Switched to subprocess.run() with an argument list (no shell=True), so
there's nothing left for a shell to interpret regardless of what the
path contains. Same fix applied in both duplicate locations
(.claude/skills and .agents/skills) since the files are identical.

Reviewed scripts/lib/tts.mjs's child_process usage as part of the same
report -- not included in this PR, it already passes args as a real
array with no shell:true anywhere in the call chain, so it isn't
actually exploitable.
---
 .agents/skills/manimgl-best-practices/templates/3d_scene.py   | 4 ++--
 .../skills/manimgl-best-practices/templates/basic_scene.py    | 4 ++--
 .agents/skills/manimgl-best-practices/templates/math_scene.py | 4 ++--
 .claude/skills/manimgl-best-practices/templates/3d_scene.py   | 4 ++--
 .../skills/manimgl-best-practices/templates/basic_scene.py    | 4 ++--
 .claude/skills/manimgl-best-practices/templates/math_scene.py | 4 ++--
 6 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/.agents/skills/manimgl-best-practices/templates/3d_scene.py b/.agents/skills/manimgl-best-practices/templates/3d_scene.py
index 5c2da873..a9c13dca 100644
--- a/.agents/skills/manimgl-best-practices/templates/3d_scene.py
+++ b/.agents/skills/manimgl-best-practices/templates/3d_scene.py
@@ -254,5 +254,5 @@ class LightingTemplate(Scene):
 
 
 if __name__ == "__main__":
-    import os
-    os.system(f"manimgl {__file__} ThreeDSceneTemplate")
+    import subprocess
+    subprocess.run(["manimgl", __file__, "ThreeDSceneTemplate"])
diff --git a/.agents/skills/manimgl-best-practices/templates/basic_scene.py b/.agents/skills/manimgl-best-practices/templates/basic_scene.py
index c46d65ad..1df13734 100644
--- a/.agents/skills/manimgl-best-practices/templates/basic_scene.py
+++ b/.agents/skills/manimgl-best-practices/templates/basic_scene.py
@@ -130,5 +130,5 @@ class AnimationShowcase(Scene):
 if __name__ == "__main__":
     # This allows you to run: python basic_scene.py
     # (though using manimgl is recommended)
-    import os
-    os.system(f"manimgl {__file__} BasicSceneTemplate")
+    import subprocess
+    subprocess.run(["manimgl", __file__, "BasicSceneTemplate"])
diff --git a/.agents/skills/manimgl-best-practices/templates/math_scene.py b/.agents/skills/manimgl-best-practices/templates/math_scene.py
index 201d7d8c..bdab3585 100644
--- a/.agents/skills/manimgl-best-practices/templates/math_scene.py
+++ b/.agents/skills/manimgl-best-practices/templates/math_scene.py
@@ -329,5 +329,5 @@ class MatrixTemplate(Scene):
 
 
 if __name__ == "__main__":
-    import os
-    os.system(f"manimgl {__file__} MathSceneTemplate")
+    import subprocess
+    subprocess.run(["manimgl", __file__, "MathSceneTemplate"])
diff --git a/.claude/skills/manimgl-best-practices/templates/3d_scene.py b/.claude/skills/manimgl-best-practices/templates/3d_scene.py
index 5c2da873..a9c13dca 100644
--- a/.claude/skills/manimgl-best-practices/templates/3d_scene.py
+++ b/.claude/skills/manimgl-best-practices/templates/3d_scene.py
@@ -254,5 +254,5 @@ class LightingTemplate(Scene):
 
 
 if __name__ == "__main__":
-    import os
-    os.system(f"manimgl {__file__} ThreeDSceneTemplate")
+    import subprocess
+    subprocess.run(["manimgl", __file__, "ThreeDSceneTemplate"])
diff --git a/.claude/skills/manimgl-best-practices/templates/basic_scene.py b/.claude/skills/manimgl-best-practices/templates/basic_scene.py
index c46d65ad..1df13734 100644
--- a/.claude/skills/manimgl-best-practices/templates/basic_scene.py
+++ b/.claude/skills/manimgl-best-practices/templates/basic_scene.py
@@ -130,5 +130,5 @@ class AnimationShowcase(Scene):
 if __name__ == "__main__":
     # This allows you to run: python basic_scene.py
     # (though using manimgl is recommended)
-    import os
-    os.system(f"manimgl {__file__} BasicSceneTemplate")
+    import subprocess
+    subprocess.run(["manimgl", __file__, "BasicSceneTemplate"])
diff --git a/.claude/skills/manimgl-best-practices/templates/math_scene.py b/.claude/skills/manimgl-best-practices/templates/math_scene.py
index 201d7d8c..bdab3585 100644
--- a/.claude/skills/manimgl-best-practices/templates/math_scene.py
+++ b/.claude/skills/manimgl-best-practices/templates/math_scene.py
@@ -329,5 +329,5 @@ class MatrixTemplate(Scene):
 
 
 if __name__ == "__main__":
-    import os
-    os.system(f"manimgl {__file__} MathSceneTemplate")
+    import subprocess
+    subprocess.run(["manimgl", __file__, "MathSceneTemplate"])