VISUAL is okay. Also doesn't need to be a path.

I don't believe this opens an untoward attack vector -- if your attacker
can run Metasploit locally, you have much bigger problems.