fix: sanitize subprocess call in start_server.py

[orbisai0security]

Summary

Fix high severity security issue in vllm_plugin/scripts/start_server.py.

Vulnerability

Field	Value
ID	V-001
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-001
File	vllm_plugin/scripts/start_server.py:35
CWE	CWE-78

Description: At start_server.py line 35, subprocess.run is called with shell=True, causing the entire cmd string to be passed to /bin/sh for interpretation. The cmd variable is constructed from CLI arguments and configuration values. Any shell metacharacters present in cmd (e.g., semicolons, backticks, pipe characters, dollar signs) will be executed as separate shell commands. If any portion of cmd originates from user-controlled input such as CLI arguments, environment variables, or writable configuration files, an attacker can inject arbitrary OS commands that execute with the full privileges of the server process.

Changes

• vllm_plugin/scripts/start_server.py

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security