Again, we have method called `escape_for_shell` which should be used to encode the cmd and all parameters. Please use it here, grep the codebase for examples.

Why do you separate the command and args? I think this could be in one single string, what you think?