The Python documentation makes it clear that having shell=True in your call to subprocess.check_output (and other functions) is a potential security risk. If you're getting input from an unknown or ...

Learn which Python standard library modules are headed for the boneyard in Python 3.13, and how to replace them. ... subprocess in the standard library is the way to handle such things now.