Ghost in the shell script: Boffins reckon they can catch bugs before programs run