Static analysis flags command injection vulnerability in build.py

Static analysis is flagging this code section as being vulnerable to command injection:

build.py (101-105):

llvm_config = os.environ.get('LLVM_CONFIG', 'llvm-config')
print("LLVM version... ", end='')
sys.stdout.flush()
try:
out = subprocess.check_output([llvm_config, '--version'])

The value of the env variable LLVM_CONFIG is directly used for an executable.

Start by reviewing build.py lines 101-105 and the surrounding LLVM version-check path, then determine how LLVM_CONFIG is handled and whether existing build tests cover it. Done means the version check still works with supported configurations and the reported command-injection warning is resolved or clearly addressed.

Written by the indexing model from the issue text.