This looks like it might effectively allow any argument to be run in the shell of a remote machine. Are we sure that's what we want to allow here?