mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-07-30 09:40:44 +00:00
All four call sites already pass `cmd` as a Python list, so Python's default of `shell=False` means there is no active command-injection risk. This change makes the security intent explicit, prevents accidental future regression if a call site is later changed to pass a string, and improves code clarity. No functional behaviour is changed.