It could be the "self-extradition command", as they call it, that exposed it, rather than echo $SHELL.