Don't Just Run

Analyzer

What is this about to do?

Submit is a GET. The briefing is rendered on the server from ?q= or ?c=, so a browser that never hydrates still sees CRITICAL on curl | bash.

Analyzed in your request. We do not store pastes. Registry lookups send package names only.

Risk briefing

Recursive force-delete

rm -rf permanently deletes files. If the path is broader than you think — or an AI guessed the folder — you can lose work you cannot get back.

DANGEROUS

Command

rm -rf node_modules dist

Rendered on the server from the query string — works without client JavaScript.

Findings

  • DANGEROUS

    Recursive force-delete

    destructive

    rm -rf permanently deletes files. If the path is broader than you think — or an AI guessed the folder — you can lose work you cannot get back.

    rm -rf node_modules dist

What this touches

  • filesystem/rm -rf node_modules dist

Safer alternatives

  1. Use a trash can, or list first

    ls -la <dir> && rm -rf <dir>

    Confirm the path. Many systems have trash-cli / gi trash instead of rm.

  2. Read it as if a stranger sent it

    AI chat will cheerily suggest pipe-to-shell installs. If you would not run this from an unknown Slack DM, do not run it from a model either.

Analyze · Don't Just Run