I think this is allowed because of `shell=True`.