I disagree, shelling out to another program is a perfectly reasonable design decision, one that has paid off in development speed. The people that run from their OS like it's something to be scared of are really missing out on the benefits of the their OS. I have built whole pipelines of essentially shell commands and I have never had a command injection vulnerability because I follow one simple rule:
I filter and sanitize input as soon as I receive it from the user. There are an infinitesimally small number of instances where you need to process anything but [a-zA-Z0-9]+ charset in a shell pipeline.
Once you have a pattern down for safely executing commands, there is no reason to be scared. It's really a myth that you can't become "secure", and this author's blog post is a perfect example. Tell me how you will conduct command injection when you have a whitelist of a-z0-9. I need an example, instead of this fear mongering that your OS is something to run and hide from.