code: func (r *subprocess) Match(n ast.Node, c *gosec.Context) (*gosec.Issue, error) {
  	if node := r.ContainsCallExpr(n, c, false); node != nil {
  		for _, arg := range node.Args {
  			if ident, ok := arg.(*ast.Ident); ok {
  				obj := c.Info.ObjectOf(ident)
  				if _, ok := obj.(*types.Var); ok && !gosec.TryResolve(ident, c) {
  					return gosec.NewIssue(c, n, r.ID(), "Subprocess launched with variable", gosec.Medium, gosec.High), nil
  				}
  			}
  		}
  		return gosec.NewIssue(c, n, r.ID(), "Subprocess launching should be audited", gosec.Low, gosec.High), nil
  	}
  	return nil, nil
  }
docs: // TODO(gm) The only real potential for command injection with a Go project
  // is something like this:
  //
  // syscall.Exec("/bin/sh", []string{"-c", tainted})
  //
  // E.g. Input is correctly escaped but the execution context being used
  // is unsafe. For example:
  //
  // syscall.Exec("echo", "foobar" + tainted)