It's easy to embed arbitrary shell code in a line starting with 'X', which the suggested egrep command would fail to detect.