ai-changelog-generator

The application uses `child_process.execSync` and `child_process.spawnSync` extensively for Git operations (`git log`, `git status`, `git show`, `git add`, `git commit`, `git diff`, `cat`). While `spawnSync` with an array of arguments is generally safer, `execSync` is used with string interpolation for constructing some Git commands (e.g., `git show ${commitHash}:"${filePath}"`, `cat "${filePath}"`). If `commitHash` or `filePath` could be influenced by untrusted user input without robust sanitization, this could lead to command injection vulnerabilities. No hardcoded secrets were found, and API keys are expected from environment variables. Network calls to various AI providers are inherent to its functionality.