fix: remove unsafe exec() in tracer.go

[orbisai0security]

Summary

Fix high severity security issue in pkg/trace/tracer.go.

Vulnerability

Field	Value
ID	V-003
Severity	HIGH
Scanner	multi_agent_ai
Rule	V-003
File	pkg/trace/tracer.go:274
CWE	CWE-22

Description: The application integrates libbpfgo (v0.9.2) and resurgo (v0.4.2) to load and execute eBPF programs, which requires CAP_BPF or CAP_SYS_ADMIN privileges. The security assessment does not confirm that the application drops these elevated capabilities after the BPF programs are loaded, meaning the entire process lifetime (including file I/O, argument parsing, and report generation) runs with kernel-level privileges. This privilege retention critically amplifies the impact of all other vulnerabilities in the application: the path traversal findings (V-001, V-002) become capable of overwriting any file on the system when combined with root/CAP_SYS_ADMIN execution. Additionally, the eBPF tracing capability can observe sensitive data from all processes on the system.

Changes

• pkg/trace/tracer.go

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security