[xps] Command Injection via insecure command concatenation

I would like to report a `Command Injection` issue in the `xps` module. It allows to execute arbitrary commands on the victim's PC.

// https://github.com/robotlolita/xps/blob/master/lib/linux.js#L48
...
var shell = require('./utils').shell;
... 
exports.kill = kill;
function kill(pid) {
  return shell('kill', ['-9', pid]).map(K(undefined));  // <-- user's input
}

// --------------------------------------------------
// …