I was tempted to expand that with "without pasting a malicious command in it", with Discord users being tricked into doing this in their Chrome console as the example.

However, most of HN is curl-bashing unverified scripts into their computers and servers...