Answering to myself as I can't edit my response any more. I've investigated a bit more and the attack as described by Greshake[1] seems to be much more realistic to me than I initially thought.
osascipt line does look a bit dodgy to me but perhaps is safe. But I can see how things might go downhill quickly with this approach...