diff --git a/autoforge/harness/run_goal.py b/autoforge/harness/run_goal.py
index f03aae0..2aaea3d 100644
--- a/autoforge/harness/run_goal.py
+++ b/autoforge/harness/run_goal.py
@@ -7,6 +7,7 @@
 
 from __future__ import annotations
 
+import shlex
 import subprocess
 import sys
 from pathlib import Path
@@ -126,7 +127,9 @@ def _goal_coverage(description: str, config: dict) -> None:
     """Run tests and report coverage."""
     test_cmd = config.get("test", {}).get("command", "pytest -v")
     print(f"Running: {test_cmd}")
-    result = subprocess.run(test_cmd, shell=True, timeout=300)
+    # Security: avoid shell=True to prevent shell injection from YAML config.
+    # Detected by Survey2Ship SecurityScanner (claim-0003 / arxiv:2604.07223)
+    result = subprocess.run(shlex.split(test_cmd), timeout=300)
     if result.returncode == 0:
         print("Tests passed.")
     else: