shell=True detection can be bypassed through variable assignment

[2002lcy0401]

Summary

The scanner's Tool Misuse detection can be bypassed by assigning the shell argument to a variable instead of using shell=True directly.

Original:

command = f'python a.py'
result = subprocess.run(
    command,
    shell=True,
    capture_output=True,
    text=True
)

Result:

Risk score: 76
Severity: HIGH
Recommendation: DO_NOT_INSTALL
TM1: Tool Parameter Abuse detected

Variant:

command = f'python a.py'
a = True
result = subprocess.run(
    command,
    shell=a,
    capture_output=True,
    text=True
)

Result:

Risk score: 46
Severity: MEDIUM
Recommendation: CAUTION
TM1 finding is missing

Expected Behavior

Both variants should receive equivalent findings because a statically resolves to True.

Impact

A simple variable assignment removes the TM1 high-severity finding and significantly reduces the overall risk score, which may affect installation recommendations.

Suggested Fix

Add constant propagation / variable resolution for sensitive parameters such as shell, so values that statically resolve to True are treated the same as direct shell=True.

Reproduction results

Here are the comparative JSON results provided

adv.json
ori.json