Report vuln for apache_mod_cgi_bash_env

Now with fewer false positives! It's kinda like a check method.
I would say a more awesome check would be

a) request without bash exploitation ont he user-agent
b) check response, confirm there isn't marker in the answer
c) request again, this time with bash exploitation on the user-agent
d) check response, confirm there is marker int he answer and report vuln!

What do you think?