Passing a format!-built string as a process argument can inject commands or flags.
Pass fixed arguments as separate .arg() values; never build args from untrusted input.