[Security] Large execa() attack surface without static analysis

[Mossaka]

Priority

Low

Description

The codebase uses execa() extensively for running shell commands, which creates a large attack surface for command injection vulnerabilities. Currently, there's no static analysis to detect unsafe usage patterns.

Impact

• Severity: Low (assuming current code is safe)
• Attack Vector: Command injection if user input flows to execa() calls
• Risk: Arbitrary command execution

Proposed Solution

1. Add static analysis tool to detect unsafe execa() usage
2. Consider using ESLint plugin for detecting command injection patterns
3. Add unit tests for all execa() call sites with untrusted input

Tools to Consider

• eslint-plugin-security
• semgrep with custom rules

Effort Estimate

~4 hours

References

• Source: Daily Security Review Discussion [Security Review] Daily Security Review - January 16, 2026 #228