confusion regarding python and python3 command

two things:

(1) don’t use os.system unless you want to get shell injected (prefer subprocess.call for example)

imagine if your infolder was named '; touch pwnd' (or something more nefarious!)

(2) use sys.executable in place of python or python3. sys.executable refers to the executable you’re running with

putting that all together, you’d have something like this:

subprocess.call((sys.executable, 'watermark.py', '--in', infolder))