[CRITICAL] exec() and execSync() have no command filtering or env restrictions

[NotKiwy]

shell/exec.js:19-20 uses exec() with shell: true

full process.env gets dumped right in, no allowlist. extension can straight up run whatever it wants

shell/run.js:13-19 does the same but sync. execSync() blocks the whole main thread. extension can freeze the app with infinite loops or heavy ass commands

shell/kill.js:40 uses execSync() with unsanitized name interpolation, no escaping. any extension can inject commands via ; or &&. also process.kill on line 48 can kill any process, not just child ones

so basically any extension can run systen commands, hang the app or kill random processes.

fix: whitelist allowed commands, filter env vars, sanitize inputs and use execFile instead of exec wherever possible.