Merge pull request #66 from luojiyin1987/fix/harden-command-exec-and-js-escaping

fix: harden command execution and JS literal escaping

skills/baoyu-format-markdown/scripts/autocorrect.ts

@@ -1,10 +1,10 @@
-import { execSync } from "child_process";
+import { spawnSync } from "node:child_process";
+import process from "node:process";
 
 export function applyAutocorrect(filePath: string): boolean {
-  try {
-    execSync(`npx autocorrect-node --fix "${filePath}"`, { stdio: "inherit" });
-    return true;
-  } catch {
-    return false;
-  }
+  const npxCmd = process.platform === "win32" ? "npx.cmd" : "npx";
+  const result = spawnSync(npxCmd, ["autocorrect-node", "--fix", filePath], {
+    stdio: "inherit",
+  });
+  return result.status === 0;
 }