Address CodeFactor findings

[jmgate]

See here. Not sure why these popped up in #297, as that didn't touch the example files at all.

[jmgate]

I think all that's required to deal with this is to remove shell=True and replace the string (e.g., "echo 'Hello world'") with a list of strings (e.g., ["echo", "'Hello world'"]).