[gfc] Command Injection via insecure command formatting

I would like to report a `Command Injection` issue in the `gfc` module. It allows to execute arbitrary commands on the victim's PC.

// https://github.com/jonschlinkert/gfc/blob/master/index.js#L80
...
const cp = require('child_process');
...
const firstCommit = async(cwd, options, callback) => {
    ....
    const opts = Object.assign({ cwd: cwd }, options);
    ....
    .then(async() => {
      return await …