I believe the real test would be if this accounted for (at least) people's aliases, and perhaps functions. So parse their .bashrc, .zshrc, .profile, etc. and expand the commands using those aliases to see if the eventual command executed matches the one that is expected here.