[Freeswitch-users] Masking caller

Hi everyone, I'm trying to mask the caller_id_name in a FreeSWITCH dialplan to prevent the real phone numbers to show up in our conferencing software. Someone sent me the following lines: <action application="set" data="MASK=${system echo ${caller_id_name} | grep -o -P '.{0,4}$' | sed 's/^/xxx-xxx-/' }"/> <action application="set_profile_var" data="caller_id_name=${MASK}"/> While this works perfectly and does exactly what I want, I'm unsure about potential security risks. The caller_id_name ends up in a shell command after all and I'm wondering if someone could send a name like `; rm /*` (you get the idea). Is this safe? Is the caller_id_name sanitized? Is there a better way to do something like this? Best regards, Lars