They could, you can try for yourself: git='() { echo hello; }' bash -c git but it's generally understood that attackers should not be able to provide envi

They could, you can try for yourself: git='() { echo hello; }' bash -c git but it's generally understood that attackers should not be able to provide enviroment variable names. If the attacker can do that, they can also provide an alternative LD_PRELOAD variable. Though IMO, yes this is risky.