// Construct the command we want the $SHELL to execute
    let command = format!("cd {:?}; /usr/bin/env -0;", dir);

SQL Injection-like attacks continues to resurface. You should pass it as a parameter in the future. Untested, but something like this:

    format!("cd \"$1\"; ...");
    command.args([command, dir]);