It appear you have your string inlcude the EXEC portion already. When you run EXEC (@osql) it seems to come down to

Exec Exec XP_CMDshell .....

ELiminating this may not not fix your issue but may give a slightly different error message.

Or maybe I don't know the workings of the EXEC function well enough.

Best

Mark