Prevent filesystem access in custom command execution