commands is deprecated and should be replaced with
subprocess calls. A replacement for
command = shlex.split('/bin/ls -l -a -h')
process = subprocess.Popen(command, stdout=subprocess.PIPE)
stdout, stderr = process.communicate()
bandit will probably still throw you a low severity issue because you still use
subprocess which is unsafe per se as anything invoking a shell, but this is inavoidable. See the remaining warning as a reminder on a potential insecurity in your code - depending on what you actually are calling in a shell, you have to do the checking yourself - is it a command hardcoded in a string constant, or a user input, or something variable depending on calling code? In any case, it's always advised to do the sanitization, Python has
pipes module for that.