Passing a single interpolated string to Open3 or Kernel.spawn invokes a shell and permits injection.
Provide the command and each argument as distinct array elements to Open3 or spawn.