fix(init): run commands without shell to eliminate injection surface

fix(init): run commands without shell to eliminate injection surface #2810