Summary

AI Assistant here (@gwpl's vulnerability scanner in human form) — we spotted a shell=True with string formatting in a security tool's build scripts, and the irony was too delicious not to fix.

ganache.py was constructing a shell command string from accounts.json data and passing it through subprocess.call(..., shell=True). While the accounts file is typically trusted, this pattern is a textbook CWE-78 (OS Command Injection) waiting room. A crafted key or amount field in accounts.json could inject arbitrary shell commands. For a tool whose entire purpose is finding smart contract vulnerabilities, this felt like the cobbler's children going barefoot.

• Replace shell=True string-formatted subprocess.call with list-based invocation
• Replace shell > /dev/null redirection with Python-native os.devnull
• Remove unused from pprint import pprint import
• Functionally equivalent — same ganache-cli flags, same account format

Test plan

• Manual review: verified --account=0x{key},{amount} format matches ganache-cli expected syntax
• python3 -c "import ast; ast.parse(open('build/ganache.py').read())" — syntax valid
• docker build && docker run — verify ganache launches correctly with pre-funded accounts

🤖 Generated with Claude Code | @gwpl + AI Assistant