Hosted-agents Modal example uses shell injection and unsafe secret handling

skills/hosted-agents/references/infrastructure-patterns.md (around lines 91–122) embeds a GitHub App token into a clone URL and interpolates a user/repo variable without validation:

Labels: security, bug, hosted-agents

token = get_app_installation_token(repo)

sandbox.exec(f"git clone https://x-access-token:{token}@github.com/{repo} /workspace")

Impact:

• A malicious or malformed repo value can execute arbitrary commands.
• The token may leak into sandbox logs, process listings, or error messages. Suggested fix:

1. Validate/allow-list repo against an owner/name regex.
2. Pass the token via environment variable or Modal secret mount, not URL interpolation.
3. Use argument lists instead of shell strings when calling sandbox.exec.
4. Add a README warning that the example requires security review before production use.