Because notifications come from an untrusted source, use of the shell prevents a major security vulnerability. Calls to external programs should be rewritten with security in mind.