Review Go for command and template injection

exec with sh -c, and text/template used where html/template is required, are the two classic Go review findings.