diff --git a/src/HookFactory.php b/src/HookFactory.php
index d86f9b2..dc4e70e 100644
--- a/src/HookFactory.php
+++ b/src/HookFactory.php
@@ -147,9 +147,9 @@ public function generateHook($type, $programPath, $programName = null, $multiple
         $programName = $programName ?: $programPath;
 
         if ($multiple) {
-            $completionCommand = '$1 _completion';
+            $completionCommand = '"$1" _completion';
         } else {
-            $completionCommand = $programPath . ' _completion';
+            $completionCommand = escapeshellarg($programPath) . ' _completion';
         }
 
         // Pass shell type during completion so output can be encoded if the shell requires it