Pass commands a list to subprocess. Only use shell=True if required.

[NMNS93]

No description provided.

[aledj2]

this can fail if a list of strings are provided

[RachelDuffin]

Setting the shell parameter to true or another truthy value when invoking a subprocess can introduce security vulnerabilities, as it allows shell metacharacters and whitespace to be passed to child processes, potentially leading to shell injection attacks