The example code is just copied from command injection tests, that is not too important. The important part is that `jumpStep` says there is flow from the import of `os` to `app.route()` :O
