Test runner script expects command name to run in a condition check. This check should be rewritten so that it converts truthy/falsy arguments and doesn't allow external commands to control its flow - it's a vector for command injection from bad actors.