root/pypi: links for command-injection