fix shell injection possibility in command class