Passing an interpolated string to system or exec runs it through a shell, enabling command injection.
Pass command and arguments as separate array elements to avoid shell interpretation.