add a test script that backdoors `ls`