fix(security): convert shell=True to shlex.split in cli.py and mcp_catalog.py

hermes_cli/mcp_catalog.py

@@ -359,12 +359,24 @@ def _install_root() -> Path:
 def _run_bootstrap(cwd: Path, commands: List[str]) -> None:
     """Execute bootstrap commands in *cwd*. Raise CatalogError on first failure.
 
-    Each command runs through the shell (so `&&` etc. work). The output is
-    streamed to the user's terminal for visibility.
+    Each command is split via ``shlex`` and run without ``shell=True`` to
+    prevent injection from untrusted YAML catalog entries.  Shell operators
+    (``&&``, ``||``, ``|``) are **not** supported — use separate command
+    entries instead.
+
+    Raises ``CatalogError`` on non-zero exit or malformed commands.
     """
+    import shlex
+
     for cmd in commands:
         print(color(f"  $ {cmd}", Colors.DIM))
-        proc = subprocess.run(cmd, cwd=str(cwd), shell=True)
+        try:
+            args = shlex.split(cmd)
+        except ValueError as exc:
+            raise CatalogError(
+                f"bootstrap command has malformed shell syntax: {cmd!r} ({exc})"
+            ) from exc
+        proc = subprocess.run(args, cwd=str(cwd), shell=False)
         if proc.returncode != 0:
             raise CatalogError(
                 f"bootstrap step failed (exit {proc.returncode}): {cmd}"