Paste a bash or zsh command from a chat, a README or an AI agent. See what each part does and which parts are risky, with a reason for each.
A shell command checker splits your text the way bash or zsh would, then looks at each command for known risky shapes, and this one lists every match with a severity and a reason. The splitter understands single and double quotes, ANSI-C $'...' strings, backslash escapes, comments, line continuations, pipes, && and ||, redirections, here-documents, $(...) and backtick substitutions, ${...}, and process substitution. It looks inside bash -c strings, eval strings and here-documents that feed a shell. It unwraps sudo, env, xargs, nohup, nice and timeout so that sudo rm -rf is checked as rm. Nothing is run, and aliases, functions and variable values are not known to it.
Severity has four levels. Critical is damage that is hard or impossible to undo, such as rm -rf on /, your home folder or a system folder, dd or a redirect onto a disk like /dev/sdb, mkfs on a device, a fork bomb, a download piped into sudo bash, or a reverse shell. High covers rm -rf with a variable or wildcard path, curl piped into a shell, git push --force, chmod -R 777, setuid bits, find -delete on a system folder, shutdown, and crontab -r. Medium covers sudo, eval, plain rm -r, git reset --hard, dd to a file, and an unquoted variable in a command that deletes or moves files. Low covers smaller things, such as > overwriting a file or curl -k. Worked example: rm -rf $BUILD_DIR/* is High, because if BUILD_DIR is empty the path becomes /*.
In bash and sh, an unquoted variable is split at spaces and its wildcards are expanded, so a value such as my files turns one argument into two. That is why mv $FILE /tmp is rated Medium and echo $NAME is rated Low. zsh does not split an unquoted variable by default, so with zsh selected the same finding is Low, but the line still breaks if someone runs it with bash. The fix in both is double quotes: mv "$FILE" /tmp. For rm -rf, quoting is not enough on its own: "${BUILD_DIR:?}"/* stops the command with an error when the variable is empty or unset.
When nothing is found the tool says None found, and that is not the same as safe. The rules are a fixed list. They cannot know what a variable holds, what an alias or function does, whether a path exists, or what a script you download contains. A command can be harmless in the pattern sense and still delete the wrong folder because you are in the wrong directory. Use the explanation to read the command, run it first with a dry-run flag where one exists, such as rsync -n or git clean -n, and keep a backup of anything you cannot replace. Input is limited to 100,000 characters and about 1,500 commands.
The checker rates it High, or Critical with sudo or a plain http:// address. The script is downloaded and run in one step, so you never see it first. Save it with curl -fsSL URL -o install.sh, read it, then run bash install.sh.
If DIR is empty or unset, $DIR/* becomes /*, which matches every top-level folder. Quote it and add a guard: rm -rf "${DIR:?}"/* exits with an error when DIR is empty. Run ls with the same pattern first to see what it matches.
It gives every user on the machine read, write and execute access to every file below the path. Use 755 for folders and 644 for files, and give write access only to the user or group that needs it.
Yes. Paste the full command, including pipes and sudo. The tool also reads strings passed to bash -c and eval, and here-documents given to a shell. It reports patterns only, so a person should still read the explanation before approving anything that deletes, installs or sends data.
A force push moves the remote branch to your version and can drop commits that others pushed. git push --force-with-lease is rated Medium, because it refuses when the remote changed since your last fetch.
No. It is processed in your browser, in this tab, and no server receives it. Your bash or zsh choice is saved in this browser, the command is not.