Use list form with shlex.split() for pkg-config flags instead of shell=True string interpolation. Eliminates command injection vector.