fix: Command injection via unvalidated input

[mrwind-up-bird]

AutoFix: Command injection via unvalidated input

Category: security
Severity: high

Issue

Git diff commands use string interpolation without input validation, allowing shell injection through crafted branch names or file paths in PR titles and commit messages.

Fix

The fix adds proper shell escaping by wrapping the GitHub context variables in double quotes. This prevents command injection through crafted branch names, commit SHAs, or PR titles that could contain shell metacharacters. The change is minimal and preserves the existing functionality while adding protection against shell injection attacks.

---

Generated by nyxCore AutoFix

[codecov]

Codecov Report

❌ Patch coverage is 53.79630% with 998 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
cmd/ckb/setup.go	0.0%	161 Missing ⚠️
internal/suggest/analyzer.go	53.6%	142 Missing and 12 partials ⚠️
internal/testgap/analyzer.go	12.3%	140 Missing and 2 partials ⚠️
internal/query/compound_refactor.go	37.1%	105 Missing and 15 partials ⚠️
internal/query/prepare_rename.go	0.0%	70 Missing ⚠️
internal/mcp/server.go	19.1%	51 Missing and 4 partials ⚠️
internal/mcp/tool_impls_compound.go	46.3%	41 Missing and 10 partials ⚠️
internal/query/prepare_move.go	63.1%	32 Missing and 6 partials ⚠️
internal/audit/analyzer.go	21.0%	30 Missing ⚠️
internal/query/compound.go	25.0%	24 Missing and 3 partials ⚠️
... and 13 more

Additional details and impacted files

@@            Coverage Diff            @@
##           develop    #162     +/-   ##
=========================================
+ Coverage     45.1%   45.6%   +0.5%     
=========================================
  Files          350     367     +17     
  Lines        59747   61934   +2187     
=========================================
+ Hits         26961   28285   +1324     
- Misses       30960   31736    +776     
- Partials      1826    1913     +87     

Flag	Coverage Δ
unit	45.6% <53.7%> (+0.5%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

📢 Thoughts on this report? Let us know!

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.