Description

This PR addresses a command injection vulnerability in install_droid() where file paths were directly interpolated into command strings. This could allow arbitrary code execution if the path contained shell metacharacters.

Fix

• Replaced string interpolation with array-based command execution.
• This ensures that paths are treated as arguments rather than executable shell commands.

Verification

• Verified that the generated settings.json now uses an array for the command field, which Factory Droid handles safely.
• Added a reproduction test case (locally) to confirm that the array-based approach prevents shell interpretation.