diff --git a/.github/scripts/process-templates.js b/.github/scripts/process-templates.js
index 97e9622..2b4e999 100644
--- a/.github/scripts/process-templates.js
+++ b/.github/scripts/process-templates.js
@@ -34,6 +34,11 @@ function getBranch(repoUrl) {
 
 // Function to get repository information (last commit date and stars)
 function getRepoInfo(repoPath, branch = 'main') {
+  // Validate branch name to prevent command injection via shell metacharacters
+  if (!/^[a-zA-Z0-9/_.\-]+$/.test(branch)) {
+    console.error(`Skipping repo info: invalid branch name "${branch}"`);
+    return { lastCommitDate: null, stars: 0, forks: 0 };
+  }
   const info = {
     lastCommitDate: null,
     stars: 0,