I'd want a better reason before shelling out personally. Apart from security, other issues are: - performance. Obviously that depends on the circumstances but

I'd want a better reason before shelling out personally. Apart from security, other issues are: - performance. Obviously that depends on the circumstances but if you are working on a function that is used in many places you don't know the circumstances. - error handling and reporting. Are you going to capture stderr from mkdir? If this fails can you provide a clear indication of the problem to the caller? - paths. If you run mkdir without specifying an absolute path your program may fail if $path is not what you expect. That can also be a vulnerability. - dependencies. Now you won't run in a distroless container or other cut down environment - you lose type safety Not saying "never shell out" but I've been burned by most of these so I am cautious about it.