The refusal table exercised slash, leading dot and leading dash but never a
control character, so that branch of the guard could have been dropped without
a test noticing.
Add a newline and a tab case, labelled so the value stays out of the output.
The wrapper is written through an unquoted heredoc, so the package and bin
names land in it as shell source. A package name carrying shell characters
became code that ran every time the wrapper ran.
The command name is used raw as a file name under ~/.local/bin, so a slash in
it wrote and removed somewhere else entirely.
Quote both values with printf %q, and refuse command names that are not plain
file names before anything is removed or written.
Adolanium