## Lesson — Use cross-spawn for Windows shim resolution

**Tags:** security, node, windows
**Scope:** packages/**/*.ts, !**/*.test.*, !**/*.spec.*

Use the `cross-spawn` package instead of enabling `shell: true` to resolve `.cmd` and `.bat` shims on Windows. This prevents shell-injection vulnerabilities where `cmd.exe` interprets metacharacters like `&`, `|`, and `>` in argument values.
