[SizzleUnrlsd]

Summary

Sources item of #71, from the broadened corpus: environment variables and process output are operator-controlled.

• Acceptance tests first (test: define operator-controlled sources), implementation follows.
• os.environ no longer carries COMMAND or PATH: a command or a path built from the environment is the operator's own doing, like the paths a command-line tool receives on argv. It still carries the other kinds, so an environment variable reaching urlopen or a SQL statement is still reported.
• subprocess output no longer carries PATH but keeps COMMAND: a path read from a local tool's output is not a traversal, while a downloaded script piped into a shell, the Chatbot audit finding, stays a command injection.
• Secrets: a credential-like name followed by _type, _kind, _scheme, _format, _algorithm, _method or _mode names a kind of credential, not one; token_type = "bearer" is silent.
• Snapshots: luigi loses the six findings on its cluster wrappers and test harness, httpie the two on its daemon and upload tests, InsecureGram and the FastAPI template their token_type credential. Nothing else moves, and the usage guide states the rule.

Part of #71.