core: fix security issue.

Escape arguments passed to external plugins.

Fixes #61, Fixes #12.