fix: quote spawn args

[xzhou-snyk]

• [x] Tests written and linted ℹ︎
• [ ] Documentation written ℹ︎
• [x] Commit history is tidy ℹ︎

What this does

Escape child process arguments

[snyksec]

:tada: This PR is included in version 1.1.6 :tada:

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot :package::rocket: