Documentation: Conflicting security guidance for subprocess execution

[coderabbitai]

Description

The subprocess execution documentation in Docs/wfldocs/WFL-io.md contains conflicting guidance about whether execute command "echo Hello World" runs via shell or direct execution.

Contradiction Details

• Lines 517-521 (Safe Execution section): Label execute command "echo Hello World" as SAFE direct execution without shell
• Lines 421-425 (Cross-Platform Execution section): Show the same command working cross-platform via shell (cmd.exe on Windows, sh on Unix)

This creates confusion about:

1. Whether this command invokes a shell or runs directly
2. Whether it's safe from injection attacks by default
3. How WFL resolves simple commands like "echo"

Location

• File: Docs/wfldocs/WFL-io.md
• Lines: ~421-425 and ~517-521

Context

This issue was identified during code review of PR #185 which adds subprocess execution features.

Related Links

• Pull Request: Adds subprocess execution and management #185
• Review Comment: Adds subprocess execution and management #185 (comment)

Reported by: @logbie