use child_process.execFile to prevent local command injection