[security] Only eval string when run in cmdline