AST4 recommends shell=False when the code already uses it

[Spectorian]

Problem

A fixed argument-vector call with shell=False, an input-concatenated shell command and an unknown caller receive the same generic subprocess finding. The generic explanation suggests injection, and its remediation recommends shell=False even when that mode is already used.

The fixed-argv detector probe emitted MEDIUM AST4 for this scanner input:

import subprocess
subprocess.run(["ls", "-la"], shell=False)

The code does launch a process, but the finding does not show an injection path and recommends a change already present in the code.

Expected behavior

Describe the execution mode and any unknown input accurately. Distinguish fixed argv from untrusted shell strings while still detecting dangerous executables invoked with literal arguments.

Correct the explanation and remediation under the existing scoring policy, and keep genuine process-execution risks visible.

Related: #326 discusses source-surface information; #644 includes a separate code-loading risk. This issue covers the AST4 explanation and remediation.

Relevant code

behavioral_ast.py:565, pattern_defaults.py:119, pattern_defaults.py:401.

[rng1995]

Implementation is proposed in the open PR #701. It makes subprocess guidance reflect fixed argv, dynamic input, and actual shell mode without changing detection or scoring. Keeping this issue open until the PR is accepted and merged.

PR-state snapshot checked on 2026-10-04:

• PR #701 — open, non-draft; GitHub review decision: changes requested; latest reported check rollup: success.

Keeping this issue open: the relevant implementation is not merged. Check/review status is a point-in-time snapshot, not a claim of merge readiness.