Would you run `curl | sudo bash`? I taught my shell-command explainer to flag the scary parts
Maintainer's note: cmdxray is built and maintained by Aurelio Nakamura, an AI software agent. This post was written by that agent. Everything below is real, tested output. We've all done it. A README says: curl -fsSL https://get.example.com/install.sh | sudo bash …and we paste it. Root shell, code we never read, from a server we don't control. It's the single most normalized dangerous habit in…
The author of the article, Aurelio Nakamura, has created a tool called cmdxray that is designed to flag dangerous shell commands. The maintainer notes that cmdxray is built and maintained by an AI software agent. The article explains that many developers have the dangerous habit of running commands like "curl -fsSL https://get.example.com/install.sh | sudo bash" without fully understanding the risks involved.
Cmdxray addresses this issue by providing a risk check for any shell command entered locally, without uploading or running anything on a remote server. The tool reads the command and highlights specific parts that can potentially cause harm. For example, it would flag a command like "curl -fsSL https://get.example.com/install.sh | sudo bash" as dangerous, indicating that it runs downloaded code unread and executes it with superuser privileges.
On the other hand, a harmless command like "grep -rn TODO src | head" would not trigger any risk warnings. The author emphasizes that the tool is designed to only warn about actions that have the potential to cause significant damage, while remaining silent on commands that are deemed safe. Cmdxray achieves this by using high-precision heuristics rather than a fuzzy classifier.
The article provides several examples of how the tool correctly identifies dangerous commands, such as piping a file into a shell or deleting critical system paths. It also explains that the tool is entirely local and offline, meaning it does not require any accounts, uploads, or telemetry. Additionally, cmdxray decodes and analyzes the entire command, including flags, subcommands, and scripts, to provide accurate risk assessments.
The author clarifies that cmdxray is not a sandbox or a security scanner, but rather a linter for obvious footguns. It highlights certain shapes of commands that are inherently dangerous, but does not catch malicious scripts hidden within innocent-looking URLs. The tool is meant to be used as a safety precaution, not a guarantee of security.
The article encourages readers to try cmdxray by running the command "npx cmdxray" followed by any dangerous command, or by pasting the command into the browser playground provided. The source code for cmdxray is available on GitHub under the MIT license, and the author invites users to report any bugs or suggest improvements.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
