A destructive-command scorer that recurses into sh -c and eval is present with no visible consumer.
What
A new module scores Bash commands as destructive, covering cases that simple pattern matching misses, and recursing into sh -c, eval and backtick subcommands. It carries no flag of its own, and where its verdict is consumed is not visible in the added code, so it may not affect any prompt you see yet.
Details
- Flags
rm,git reset,clean,checkout,restoreandstashwritten with quoting or brace expansion,git pushwith force-like refspecs or--delete,find -delete,shred,git clean -fwithout a dry run,xargsand-execwrappers around those, andgit -c alias.. - Strips wrapper prefixes such as
sudo,env,nice,timeout,commandandbusybox, splits pipelines while ignoring redirections andVAR=assignments, and re-checks nested commands up to a depth limit. - Input that is too long or nested too deeply is treated as risky by default.
Evidence
/(^|[;&|\n(][ \t]*)shred\s/`
Strings lifted out of the shipped bundle, so the claim above can be checked against them.