Use shell=False and a list rather than building a string and shell=True

There's no reason that I can see for using shell=True here, and it brings in
a number of risks (what if a file name has quote characters in it?). This is
safer and possibly faster, and arguably more readable as well.