Fix zsh prompt security and other issues

* Escape percent in zsh prompt
* Prevent some security issues (directory named `$(echo abc)` appeared as `abc`)
    (`"$()"` → `'$()'`)
* Removed exports

powerline/bindings/zsh/powerline.zsh

@@ -1,6 +1,4 @@
 _powerline_precmd() {
-	export PS1="$(powerline-prompt --renderer_module=zsh_prompt --last_exit_code=$? --last_pipe_status="$pipestatus" left)"
-	export RPS1="$(powerline-prompt --renderer_module=zsh_prompt --last_exit_code=$? --last_pipe_status="$pipestatus" right)"
 	_powerline_tmux_set_pwd
 }
 
@@ -25,6 +23,8 @@ _powerline_install_precmd() {
 		fi
 	done
 	precmd_functions+=(_powerline_precmd)
+	PS1='$(powerline-prompt --renderer_module=zsh_prompt --last_exit_code=$? --last_pipe_status="$pipestatus" left)'
+	RPS1='$(powerline-prompt --renderer_module=zsh_prompt --last_exit_code=$? --last_pipe_status="$pipestatus" right)'
 }
 
 trap "_powerline_tmux_set_columns" SIGWINCH

powerline/renderers/zsh_prompt.py

@@ -5,10 +5,14 @@ from powerline.renderers.shell import ShellRenderer
 
 class ZshPromptRenderer(ShellRenderer):
 	'''Powerline zsh prompt segment renderer.'''
-	def hl(self, fg=None, bg=None, attr=None):
+	def hl(self, *args, **kwargs):
 		'''Highlight a segment.
 
 		Returns the default ShellRenderer escape sequence with %{...%} wrapped
 		around it (required in zsh prompts).
 		'''
-		return '%{' + super(ZshPromptRenderer, self).hl(fg, bg, attr) + '%}'
+		return '%{' + super(ZshPromptRenderer, self).hl(*args, **kwargs) + '%}'
+
+	@staticmethod
+	def escape(string):
+		return string.replace('%', '%%')