[Security] shell=True in verification command allows command injection in API endpoint

[RReport]

Hi,

I found a potential security issue in:

anytool/local_server/main.py

Specifically in the verification logic:

verify_result = subprocess.run(
    verify_cmd,
    shell=True,
    capture_output=True,
    text=True,
    timeout=5
)

Why this is a security issue

1. The verification command verify_cmd is executed with shell=True, enabling shell interpretation.
2. verify_cmd is taken from API request payload (verification['command_success']), which can be controlled by an attacker.