You could set a policy allowing control-panel-vm to use qubes.VMShell
service.
Copy the relevant sections from /etc/qubes/policy.d/90-default.policy to a
new file, /etc/qubes/policy.d/10-vmshell.policy
Set the policy as you will -
e.g, a line like qubes.VMShell * control-panel-vm work ask
will allow you to run any installed application in the work qube from
control-panel-vm, after a prompt.
If you do this you should read carefully the health warning in
90-default.policy about using VMShell
WARNING: The qubes.VMShell service is dangerous and there are really few
cases when it could be safely used. Especially when policy set to "ask" you
have no way to know for sure what command(s) will be called. Compromissed
source VM can substitute the command. Allowing one VM to execute
qubes.VMShell over the other VM allows the former to TAKE FULL CONTROL over
the later. In most cases this is not what we want!
Instead we should be using task-specific qrexec services which provide
assurance as to what program will be responding to the (untrusted) VM
requests.