Fix command injection vulnerability in CLI preparation scripts

[Copilot]

This PR fixes a critical command injection vulnerability in three CLI preparation scripts that use execSync() with template literals containing user-controllable paths.

Vulnerability Details

The vulnerable code pattern was present in:

• src/cli/prepare-phantom.mjs
• src/cli/prepare-coinbase.mjs
• src/cli/prepare-metamask.mjs

Before (vulnerable):

execSync(`chmod +x "${scriptPath}" && "${scriptPath}"`, {
  stdio: "inherit",
  cwd: process.cwd(),
})

This pattern is vulnerable to command injection because if scriptPath contains shell metacharacters (like ; rm -rf /), they would be executed as part of the shell command.

Fix Implementation

After (secure):

const chmodResult = spawnSync('chmod', ['+x', scriptPath], {
  stdio: "inherit",
  cwd: process.cwd(),
})
if (chmodResult.error) {
  throw chmodResult.error
}

const scriptResult = spawnSync(scriptPath, [], {
  stdio: "inherit", 
  cwd: process.cwd(),
})
if (scriptResult.error) {
  throw scriptResult.error
}

Why This Fix Works

1. Array arguments: spawnSync() with array form treats each argument as a literal string, preventing shell interpretation
2. No shell expansion: Arguments cannot contain executable shell metacharacters
3. Separate operations: Split the compound command into two separate, secure calls
4. Maintained functionality: Same behavior with secure execution
5. Proper error handling: Individual error checking for each operation

Security Impact

This change eliminates the possibility of command injection attacks while preserving all existing functionality. The CLI scripts will continue to work exactly as before, but are now secure against malicious input in file paths.

Fixes #29.

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

[Copilot]

Copilot wasn't able to review any files in this pull request.

---

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

[joe10832]

/.github/copilot-instructions.md
/.github/instructions/**/*.instructions.md
**/AGENTS.md
/CLAUDE.md
/GEMINI.md

[joe10832]

/.github/copilot-instructions.md
/.github/instructions/**/*.instructions.md
**/AGENTS.md
/CLAUDE.md
/GEMINI.md

[joe10832]

@copilot