Yes, you're absolutely right, the type of security problems I mentioned about eval also apply to shelling out, I should have mentioned that explicitly. I actually don't like much the idea of shelling out, my point in that paragraph was only to say that if one decided to shell out, it might be simpler to use bc rather than heavy artillery such as an interpreter, compiler, or VM for Lisp, Lua, or JS.