OrbisAI Security cf59d0d283 fix: sanitize subprocess call in runner.py (#2149) ... * fix: V-001 security vulnerability Automated security fix generated by OrbisAI Security * fix: sanitize subprocess call in runner.py The runner * fix: address PR review comments on V-001 allowlist and test coverage Remove dangerous interpreters (python, python3, node, curl, wget) from ALLOWED_SETUP_EXECUTABLES — they can execute arbitrary code via argument flags and are not needed for sandbox setup. Rewrite test_invariant_runner to call _setup_sandbox directly instead of spawning runner.py as a subprocess (which had no __main__ entrypoint and never exercised the fix). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>		2026-06-15 13:49:45 -04:00
..
__init__.py	feat(skills): add skill-comply — automated behavioral compliance measurement (#724)	2026-03-22 21:51:49 -07:00
classifier.py	feat(skills): add skill-comply — automated behavioral compliance measurement (#724)	2026-03-22 21:51:49 -07:00
grader.py	fix(grader): handle forward after_step references	2026-04-12 23:36:16 -07:00
parser.py	feat(skills): add skill-comply — automated behavioral compliance measurement (#724)	2026-03-22 21:51:49 -07:00
report.py	feat(skills): add skill-comply — automated behavioral compliance measurement (#724)	2026-03-22 21:51:49 -07:00
run.py	feat(skills): add skill-comply — automated behavioral compliance measurement (#724)	2026-03-22 21:51:49 -07:00
runner.py	fix: sanitize subprocess call in runner.py (#2149)	2026-06-15 13:49:45 -04:00
scenario_generator.py	feat(skills): add skill-comply — automated behavioral compliance measurement (#724)	2026-03-22 21:51:49 -07:00
spec_generator.py	feat(skills): add skill-comply — automated behavioral compliance measurement (#724)	2026-03-22 21:51:49 -07:00
utils.py	feat(skills): add skill-comply — automated behavioral compliance measurement (#724)	2026-03-22 21:51:49 -07:00