developer change code is not a issue, just wondering if end user or hacker can pass in those kinds of string as part of your compose on the RunCmd