在stackoverflow找到了原因和解决方案：
zsh uses square brackets for globbing / pattern matching.
That means that if you need to pass literal square brackets as an argument to a command, you either need to escape them or quote the argument like this:
pip install 'requests[security]'
