fix: sanitize subprocess call in app.py

[anupamme]

Summary

Fix critical severity security issue in WAVE2SCORE/app.py.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	WAVE2SCORE/app.py:65
Assessment	Likely exploitable

Description: The application uses subprocess.run to execute external commands with user-controlled input from uploaded files. While using an array format reduces risk, the input_path variable contains user-controlled data that could include shell metacharacters.

Evidence

Exploitation scenario: Attacker uploads a .wav file with a filename containing shell metacharacters (e.g., 'input.wav; cat /etc/passwd').

Scanner confirmation: multi_agent_ai rule V-001 flagged this pattern.

Production code: This file is in the production codebase, not test-only code.

Threat Model Context

This main application appears to be publicly accessible.

Changes

• WAVE2SCORE/app.py

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security