fix: use subprocess instead of os.system in dataset_download.py

[orbisai0security]

Summary

Fix critical severity security issue in research/delf/delf/python/datasets/sfm120k/dataset_download.py.

Vulnerability

Field	Value
ID	V-001
Severity	CRITICAL
Scanner	multi_agent_ai
Rule	V-001
File	research/delf/delf/python/datasets/sfm120k/dataset_download.py:52

Description: Six os.system() calls in dataset_download.py construct shell commands by directly interpolating external variables (src_file, dst_file, dst_dir, dst_dir_old) into shell strings using Python's str.format(). No sanitization, escaping, or allowlist validation is applied to any of these variables before they are passed to the operating system shell. Because os.system() invokes a full shell interpreter, any shell metacharacters (semicolons, pipes, backticks, dollar signs, etc.) present in the variable values are interpreted and executed. These variables can be influenced by a malicious dataset registry, a compromised configuration file, a man-in-the-middle attack on the URL source, or direct CLI argument manipulation.

Changes

• research/delf/delf/python/datasets/sfm120k/dataset_download.py

Verification

• Build passes
• Scanner re-scan confirms fix
• LLM code review passed

---

Automated security fix by OrbisAI Security