infra-sage

The server executes `terraform` commands using `child_process.exec`, which runs commands via a shell. The `plan_changes` tool directly interpolates user-provided `varFile` and `target` parameters into the shell command string without sanitization or proper escaping. This creates a critical shell injection vulnerability where a malicious user could craft an argument (e.g., in `target`) to execute arbitrary shell commands on the host system. The `execAsync` function should ideally use `child_process.spawn` with arguments passed as an array to prevent shell interpretation, or meticulously sanitize inputs if `exec` is necessary.