I thought this was ironic because there's no good way to actually restrict which commands the AI runs save for sandboxing; and here it was expressing concern about OS command injection in the git commit message string argument to git. How to not use the equivalent of what subprocess calls (shell=True) which does exec code in backticks?

Would single quotes solve this

Which types of documents have this particular AI vulnerability?