session-support

The fragment appears to be a documentation and project scaffolding CLI, not intentionally malicious. However, it contains a high-impact command-injection risk because user-controlled featureName is interpolated into execSync's shell command, plus path traversal risks in filesystem paths. Template repository cloning also introduces a normal but significant third-party supply-chain trust boundary. Validate feature names, enforce containment within intended roots, and replace shell interpolation with execFile or spawn using argument arrays.