The argv form dropped the old &>/dev/null redirect, so the transcriber
output leaked to mpv terminal. Keep the command string a constant and
pass the paths as positional parameters: no interpolated shell input
(so a filename can not be parsed as shell syntax) while the redirect
that silenced the output is restored.
Verified end-to-end through the script, with the real binding and a
media file named evil$(touch PWNED).wav: argv arrived intact as a
single argument, LD_LIBRARY_PATH preserved, payload inert, no leak.
Nyra
ab2b8b798f