fix: remove unsafe exec() in graph.go

[orbisai0security]

Summary

Fix high severity security issue in pkg/gui/presentation/graph/graph.go.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	pkg/gui/presentation/graph/graph.go:1

Description: The custom command keybinding system uses Go template syntax to interpolate git-derived values — including branch names, commit hashes, file paths, and author names — directly into shell command strings. These values originate from repository data controlled by whoever created or contributed to the repository, and they are not shell-escaped before interpolation. When a user triggers a custom keybinding while a maliciously named git ref is selected, the shell metacharacters embedded in the ref name are interpreted by the shell, resulting in arbitrary command execution. This vulnerability is triggered by normal user interaction with a malicious repository and requires no special user permissions or unusual configuration beyond having any custom keybinding defined.

Changes

• pkg/utils/template.go
• pkg/gui/services/custom_commands/handler_creator.go

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security