fix: use subprocess instead of os.system in android_configure.py

[orbisai0security]

Summary

Fix critical severity security issue in android_configure.py.

Vulnerability

Field	Value
ID	V-003
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-003
File	android_configure.py:77

Description: The android_configure.py build script constructs a shell command by directly concatenating the DEST_CPU variable into an os.system() call at line 77. If DEST_CPU is sourced from an environment variable, command-line argument, or CI/CD pipeline input controlled by an attacker, shell metacharacters can be injected to execute arbitrary operating system commands on the build host with the full privileges of the build process.

Changes

• android_configure.py

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security

[Renegade334]

If DEST_CPU is sourced from an environment variable, command-line argument, or CI/CD pipeline input

Lucky it isn't, then.