Don't Just Run: a briefing before the shell command

Field notes

The site frames command review as a three-step pause: paste a suggestion, read a briefing, then decide whether to run it. Its rule categories include destructive wipes, privilege escalation, secret handling, persistence, supply-chain risks, exfiltration, and obfuscation. The example library makes the scope concrete, ranging from a supposedly ordinary npm install to a CRITICAL command that reads an SSH key and posts it to a webhook. The page identifies itself as version 1.0.0 and says submitted pastes are not stored.