RegExp.prototype.exec() incorrectly detected as shell execution

What issue are you seeing?

While testing the OpenAI Codex repository with Rune, Rune reported two
dangerous_shell_exec findings that are actually JavaScript
RegExp.prototype.exec() calls.

The affected file is:

codex-rs/skills/src/assets/samples/openai-docs/scripts/fetch-codex-manual.mjs

The two lines are:

const statusMatch = /^HTTP\/\S+\s+(\d{3})/.exec(statusLine);
and:
const match = /^(#{1,6})\s+(.+?)\s*$/.exec(line);
These calls perform regular-expression matching and do not execute a shell command or spawn a process.
Reproductionj 

### What steps can reproduce the bug?

I ran Rune against a clean checkout of Codex.
Results:
709 files scanned
953 facts
341 derived conclusions
5 security findings
1.85 seconds scan time
Two of the five findings were the RegExp.prototype.exec() calls above.
Rune reported them as:
dangerous_shell_exec Dynamic command passed to exec() severity: high



### What is the expected behavior?

A static security detector should distinguish:
/regex/.exec(value)
from actual process execution such as:
child_process.exec(command)
The regex calls should not be reported as shell execution.

### Additional information

This is not being reported as a security vulnerability in Codex.
The issue was discovered while testing an external security scanner (Rune) against the repository. The other three findings from the scan were spawn() calls and have not been classified as vulnerabilities.
The purpose of this report is specifically to document the false-positive behavior described above.

Start by running Rune against a clean Codex checkout and inspect its findings for codex-rs/skills/src/assets/samples/openai-docs/scripts/fetch-codex-manual.mjs. Confirm that the two RegExp.prototype.exec() calls are reported as dangerous_shell_exec, while child_process.exec(command) remains distinguishable; done means the regex calls no longer produce shell-execution findings.