Fix command injection vulnerability in tool_list_files

[luojiyin1987]

Summary

This PR fixes a command injection vulnerability in the tool_list_files() function in /lib/tools.sh. The vulnerability was caused by using string concatenation to build find command arguments, which could allow malicious file patterns containing special characters to execute arbitrary commands.

Changes Made

• Changed find_args variable from string to array type
• Updated parameter assignment to use array syntax
• Changed command execution to use array expansion (${find_args[@]})

Impact

This fix prevents command injection vulnerabilities when the tool_list_files function is used with untrusted input for file patterns.

Testing

• Verify that the function still works correctly with normal file patterns
• Test with patterns containing spaces and special characters
• Ensure all existing tests pass

closed #2