fix: remove unsafe exec() in util.go

[orbisai0security]

Summary

Fix critical severity security issue in drivers/local/util.go.

Vulnerability

Field	Value
ID	V-002
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-002
File	drivers/local/util.go:72
CWE	CWE-78

Description: At drivers/local/util.go lines 72 and 168, user-influenced file paths (inputFile and videoPath) are passed directly to ffmpeg.Input() without sanitization or validation. If the underlying go-ffmpeg library constructs a shell command string from these arguments — which is common in ffmpeg wrapper libraries that invoke the ffmpeg binary via exec — shell metacharacters embedded in the file path could cause arbitrary OS commands to execute with the privileges of the server process.

Changes

• drivers/local/util.go

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security