TerminalVibes / Terminal for the AI Era
Full course
Part 11

Terminal for the AI Era: Read, Verify, Run

"The AI writes the command. You decide whether it runs. That decision is the whole job."

Everything so far was building toward this. Your AI assistant proposes shell commands all day long — install this, delete that, rewrite those files, restart the server. Ten parts ago none of it was readable. Now every piece is: paths and wildcards, pipes and redirection, permissions, scripts, sed -i, kill -9, curl, installers. This part puts them together into the one skill the whole course exists for — reading a command you didn't write and deciding, with confidence, whether to let it run.

Note
This part comes late on purpose. Auditing a command means recognising every piece of it, so it had to wait until you had met the dangerous ones. You are not learning new commands here — you are learning what to do in the seconds before you press Enter.

11.1 Read Before You Run

Every AI-proposed command gets the same inspection before it earns your Enter key
Note
The Problem: Your agent says "run this to fix it" and hands you a line of symbols you can't read. Pressing Enter on faith works fine — right up until the day it doesn't. You need a routine that turns "looks fine, I guess" into an actual verdict, in under a minute.

And "the day it doesn't" is not hypothetical — this actually happens, to teams full of experts. In July 2025, a hacker slipped a destructive prompt into version 1.84 of Amazon's AI coding extension, instructing the agent to wipe users' systems and cloud resources. The same month, Replit's agent deleted a live production database during an explicit code freeze. And in April 2026, a Cursor-driven agent deleted a company's production database and its backups in about nine seconds. In every case the missing safeguard wasn't more expertise on the team — it was a human who read the command before approving it.

Here's the routine. Four steps, same order, every time. It feels slow for the first week; after that it takes fifteen seconds and runs in your head automatically.

1

Name the command

The first word is the program. Do you know what it does? rm deletes, curl downloads, chmod changes permissions. If the first word is a stranger, man <command> or a quick "what does this do?" to your AI comes first.

2

Read each flag

Flags change behavior, sometimes drastically: rm and rm -rf are different animals. And a letter means whatever its own command decided it means (Getting Help) — so look each one up with man or --help. Never wave through a flag you can't explain.

3

Identify what it targets

The most important question: what does this act on? A path? A wildcard? The current directory? Check where you are with pwd, and remember that * means "everything here" — whatever "here" happens to be.

4

Rehearse it

Before the real thing, run a harmless preview: echo the command to see what the wildcards expand to, or ls the target to see what would be hit. Many commands have a built-in rehearsal flag — --dry-run or -n — that shows what would happen without doing it.

Here's the routine applied to a real suggestion. The agent proposes rm -rf build/* — deleting is irreversible (Copy, Move, Delete), so it earns the full treatment:

Auditing before deleting 
# Step 1-2: rm deletes; -r recurses into folders, -f skips confirmation.
# Step 3: the target is build/* - everything inside build/, wherever I am.
pwd
# /home/vibe/projects/webapp        <- good, I'm where I think I am

# Step 4a: rehearse the glob - what does build/* actually expand to?
echo rm -rf build/*
# rm -rf build/assets build/index.html build/main.js

# Step 4b: or just look at the target directly
ls build/

# Verdict: only generated files. NOW it earns the Enter key.
rm -rf build/*
Tip
explainshell is your second opinion. Paste any command into explainshell.com and it dissects every piece — command, flags, arguments — with the matching lines from the actual man pages. It's the fastest way to check an AI's explanation against the documentation, because unlike the AI, explainshell only quotes the manual.

The Red-Flag List

Some patterns should make you slow down every time, no matter how confident the agent sounds. None of these are forbidden — they all have legitimate uses — but each one is a "stop and run the full audit" trigger:

rm -rf — recursive, forced deletion

No trash can, no confirmation, no undo (Copy, Move, Delete). The danger scales with the target: rm -rf build is routine, rm -rf * depends entirely on where you're standing, and anything involving ~ or / deserves a hard stop.

sudo — anything

sudo removes every guardrail the system has. The rule from sudo doubles here: never sudo a command you don't understand — especially one an AI wrote. Understand first, elevate second.

curl ... | bash — run code straight off the internet

You decoded this pattern in curl — Ask the Network — curl fetches a script off the internet, and the pipe feeds it straight into a shell that runs it, sight unseen. What's left is the judgement call, and honesty requires a 2026 update: this is now an official install method. Claude Code's documented installer is curl -fsSL https://claude.ai/install.sh | bash, and Codex CLI ships the same way. Four letters ride along there: f fails on a server error instead of saving the error page as your script, s silences the progress bar, S puts the real error messages back, and L follows redirects — so the script that reaches your shell can come from a different host than the address you read. Which is why the real rule is about the source: piping a script over HTTPS from the documented domain of a vendor you chose is a normal install path; piping one from a snippet someone pasted in a forum thread, a README, or an agent's suggestion is not. When in doubt the two-step version is always available — curl -o install.sh <url>, read it, then run it — and a package manager (brew, apt, or Windows' winget — Package Managers) remains the more auditable alternative. Downloading first unlocks one more check, too: vendors publish a SHA-256 fingerprint beside their installers, and shasum -a 256 install.sh prints the fingerprint of the file you actually received (Linux spells it sha256sum). If the two differ, the file is not what they shipped — stop.

> — onto a file you care about

From Text & Pipes: > truncates first — the old contents are gone before the new ones arrive. An agent "updating" your .bashrc with > instead of >> just erased it. Check the arrow count.

chmod 777 — everyone may do everything

The "make the error go away" hammer (Permissions & Config). It works by giving every user on the system full control of the file — which is almost never what the situation actually needs. If an agent reaches for 777, ask it what the minimal permission would be; the answer is usually 755 or 644.

sed -i — a silent mass edit with no undo

From Text Surgery: -i rewrites the real files in place, often across a whole glob of them, with no preview and no backup. Unlike the flags above, the fix isn't refusal — it's amendment. Ask for -i.bak, which keeps every original beside its edited version, and you get an undo button for free.

kill -9 — reached for first, not last

From Processes & Ports: plain kill asks a program to stop and lets it save its work; -9 removes it mid-sentence, skipping every cleanup. It's a legitimate last resort and a poor default — when an agent opens with it, ask whether the polite version was tried.

The newest red flag: commands the agent was tricked into proposing

One more pattern, unique to the AI era: prompt injection. Any text an agent reads — a README, a GitHub issue, a dependency's docs — can contain instructions that steer the commands it proposes next. Mozilla warned in June 2026 about exactly this kind of indirect injection through repositories, and Microsoft's "prompts become shells" research (May 2026) showed injected text escalating all the way to remote code execution in agent frameworks — someone else, somewhere else, running whatever commands they like on your machine. The consequence for you: an agent's proposed command deserves the full audit even when you didn't write the prompt that produced it — the instruction may not have come from you at all.

Important
You are the approval step. Every major agent — Claude Code, Codex CLI, Copilot's agent mode — asks "allow this command?" before running it, and OS-level sandboxing is becoming the default posture underneath — Seatbelt on macOS, bubblewrap on Linux, the operating system itself fencing in what a command can reach, a harder wall than the practice sandbox you've been running commands in. That permission prompt is the modern read-before-you-run: the skill this course teaches is what you do in the seconds it's on screen. Don't approve on autopilot — an agent can propose commands faster than you can casually skim them, and it only takes one unread rm to ruin an afternoon.

Try It: Audit the Agent

An agent left three proposed commands in agent-plan.txt — two are safe, one would wipe files you care about. Read the plan with cat, audit each command (rehearse with echo and ls!), run the safe ones, and don't run the trap.
Audit the Agent

Loading playground...

Vibe it

"Explain this command flag by flag before I run it, and tell me exactly which files it will touch"

"Rewrite this command with a dry-run or preview step first, so I can see what it would do"

Challenge: Approve the Release Plan

Loading challenge...