one-lesson-rule

This CLI monitors project progress and writes local Markdown and JSON reports. A security risk exists because an untrusted prev.head value from state.json is interpolated into an execSync shell command, enabling command injection if an attacker can control that state file; severity is moderate and context-dependent. No network exfiltration or other clear malware behavior is present.