🛡️ Sentinel: [HIGH] Fix command injection risks by removing execSync

[google-labs-jules]

🚨 Severity: HIGH

💡 Vulnerability:
Multiple instances of execSync were used throughout the CLI to execute system commands (git, where, which). execSync spawns a shell to interpret the command string, which is vulnerable to command injection if any interpolated variables (like paths or filenames) contain shell metacharacters (e.g., ;, &&, |, $()). While some uses were static, the pattern itself is unsafe and risks injection if inputs are ever derived from user-controlled sources or external config files (like .specify/init-options.json previously).

🎯 Impact:
An attacker who can control input passed into an execSync command (such as via a malformed repository name, directory path, or config file read during initialization) could execute arbitrary shell commands on the user's machine with the privileges of the Node.js process.

🔧 Fix:

1. Replaced execSync with execFileSync in cli/commands/score.mjs, cli/commands/setup.mjs, cli/ensure-skills.mjs, cli/validators/freshness.mjs, and cli/shared-git.mjs.
2. Passed executables and arguments as arrays to execFileSync to bypass shell interpolation completely.
3. Emulated shell piping (like | wc -l) natively in JavaScript (.split('\n').filter(Boolean).length).
4. Emulated stderr suppression (2>/dev/null) using Node's native stdio: ['pipe', 'pipe', 'ignore'] option.
5. Explicitly set an increased maxBuffer (1024 * 1024 * 5) for git log operations to prevent ENOBUFS (buffer exhaustion) errors that can occur when reading large histories natively without a shell pipe.

✅ Verification:

1. Ran the project test suite (node --test tests/*.test.mjs), verifying that CLI logic, git detection (isGitRepo), and system checking (isCliAvailable) remain functional.
2. Verified execFileSync was correctly imported in all modified files.

---

PR created automatically by Jules for task 2584548517710371358 started by @raccioly

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.