fix: use subprocess instead of os.system in checkPackageRuning.py

[orbisai0security]

Summary

Fix critical severity security issue in packaging/checkPackageRuning.py.

Vulnerability

Field	Value
ID	V-004
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-004
File	packaging/checkPackageRuning.py:50

Description: The serverHost variable is interpolated directly into os.system() shell command strings at lines 50, 90, and 94 of checkPackageRuning.py using Python's % string formatting. os.system() passes the resulting string to /bin/sh, which interprets shell metacharacters. If serverHost is sourced from an environment variable, configuration file, or command-line argument without sanitization, an attacker can inject arbitrary shell commands that execute with the full privileges of the packaging script.

Changes

• packaging/checkPackageRuning.py

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security