fix(lib): use execFile to avoid execing raw strings

Execing raw strings opens us up to remote execution exploits.