[Phase 1.2.3] Replace os.system() with subprocess.run()

[richard-devbot]

Phase

Phase 1 — Critical Security | Track 1.2 — Execution Controls | Priority: P1 MEDIUM

Vulnerability Details

File: operator_use/agent/tools/builtin/control_center.py:128
CWE: CWE-78

`os.system()` spawns a shell and is vulnerable to injection. Replace with `subprocess.run()`.

Fix

```python

Before

os.system("cls" if os.name == "nt" else "clear")

After

subprocess.run(["cls" if os.name == "nt" else "clear"], shell=False, check=False)
```

Acceptance Criteria

• All `os.system()` calls replaced with `subprocess.run()`
• No shell=True anywhere
• Bandit scan passes (no B605/B607 warnings)

References

• CWE-78
• Bandit B605