The CWE 78 Check contains a Ghidra script which analyses binaries for possible OS command injection based on a heuristical approach - View it on GitHub