From a3dea0d72fd44396a116459d88872f15418e4d91 Mon Sep 17 00:00:00 2001
From: xiaolai <lixiaolai@gmail.com>
Date: Mon, 22 Jun 2026 01:54:21 +0800
Subject: [PATCH] fix: replace execSync template string with execFileSync array
 form (#283)
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

execSync with a backtick template string creates a shell-expansion
surface. Although all three variables (generateScript, DESIGN_TOKENS_JSON,
DESIGN_TOKENS_CSS) are currently hardcoded constants, the pattern is
fragile — any future substitution of user-controlled data would create
shell injection.

Replace with execFileSync('node', [...args]) to eliminate the shell
entirely and make the boundary explicit.

Co-authored-by: claude[bot] <claude[bot]@users.noreply.github.com>
Co-authored-by: Claude Code <noreply@anthropic.com>
---
 .claude/skills/brand/scripts/sync-brand-to-tokens.cjs | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.claude/skills/brand/scripts/sync-brand-to-tokens.cjs b/.claude/skills/brand/scripts/sync-brand-to-tokens.cjs
index 86c19e8..e7bc171 100644
--- a/.claude/skills/brand/scripts/sync-brand-to-tokens.cjs
+++ b/.claude/skills/brand/scripts/sync-brand-to-tokens.cjs
@@ -11,7 +11,7 @@
 
 const fs = require('fs');
 const path = require('path');
-const { execSync } = require('child_process');
+const { execFileSync } = require('child_process');
 
 // Paths
 const BRAND_GUIDELINES = 'docs/brand-guidelines.md';
@@ -250,7 +250,7 @@ function main() {
   const generateScript = path.resolve(process.cwd(), GENERATE_TOKENS_SCRIPT);
   if (fs.existsSync(generateScript)) {
     try {
-      execSync(`node ${generateScript} --config ${DESIGN_TOKENS_JSON} -o ${DESIGN_TOKENS_CSS}`, {
+      execFileSync('node', [generateScript, '--config', DESIGN_TOKENS_JSON, '-o', DESIGN_TOKENS_CSS], {
         cwd: process.cwd(),
         stdio: 'inherit'
       });