hooks: don't set shell=True and use strings list for command
setup: bump to 0.5.8