fix: remove command substitution patterns from filenames during sanitization.

src/utils.py

@@ -164,7 +164,10 @@ def sanitize_filename(filename: str) -> str:
     
     # Remove consecutive dots to prevent directory traversal attempts like '..'
     filename = re.sub(r'\.{2,}', '.', filename)
-    
+
+    # remove potential $(
+    filename = re.sub(r'\$\([\s\S]*?\)', '', filename)
+
     # Ensure filename is not practically empty after sanitization
     if not filename.strip() or filename.strip().replace('.', '') == '':
          raise ValueError("Filename invalid after sanitization")