harmonyos-code-review

No clear evidence of embedded malware (no network/exfiltration, credential theft, or persistence) is present. However, the code executes shell commands via `child_process.execSync` using a command string built from interpolated `branch/since/until/maxCount` without robust validation/argument-safe APIs, which is the primary command-injection risk. Additionally, it exports repository-controlled text into CSV without preventing spreadsheet formula injection, and it writes to an unvalidated `outputPath`, creating a potential unsafe-write risk if options are untrusted.