quote the pip specifier

`fish` shell interprets the hash in #md5 as the start of a comment

I don't know if there are issues in any other shells, so this may be a bit out of your scope.