Watching people much better at this than me RE the xz backdoor and it's very much the reverse engineering scene from Hackers (spoiler it seems to take a signed payload smuggled in the form of the client's SSH pubkey and then pass that to system()) https://youtu.be/bcAACOrgVKE