Comment by detaro

If a shell was necessary, a better-secured one (e.g. requiring a signed command) would have been a good approach.