grab: Don't invoke a shell

Pass arguments directly to the subprocess, and don't start a shell to
parse them first. This also prevents shell injection attacks, because
the arguments are passed on directly. It's also faster because it
avoids an exec call.