mirror of
https://github.com/RfidResearchGroup/proxmark3.git
synced 2026-06-05 08:31:54 +00:00
orbisai0security
94c0fc2edd
All four call sites already pass `cmd` as a Python list, so Python's default of `shell=False` means there is no active command-injection risk. This change makes the security intent explicit, prevents accidental future regression if a call site is later changed to pass a string, and improves code clarity. No functional behaviour is changed.