SG-107: Obfuscated dynamic code execution
Severity: HIGH
Runtime-assembled code execution (getattr(__import__()), chained chr(), eval/exec of decoded content) that hides the payload from pattern scanners. SkillCloak Reify command-rewrite class.
Fires when
- Four or more chained `chr()` calls assemble a string from char-codes.
- `eval`/`exec` runs base64/hex-decoded or dynamically-imported/concatenated content.
- `getattr(__import__(...))` resolves a call through a dynamic import (obfuscated exec).
- A shell command downloads to a file with `curl`/`wget` then executes it (split `curl|bash`).
Remediation
No safe remediation: a file that triggers this rule should be rejected, not patched. Read the flagged lines in the source before deciding.