Your first terminal commands

The terminal is a window where you type instructions and the computer types back. It looks old-fashioned and it is the most direct way to talk to a computer, which is exactly why security people live in it, and why coding agents use it as their main tool. In this lesson you will learn seven commands and one habit.

What a terminal is

Open one now. On macOS it is called Terminal, on Windows use PowerShell or WSL, and on Linux it is usually the Terminal app.

You will see a prompt, a short line ending in $ or % or >. It is the computer waiting. You type a command, press Enter, and the shell runs it and prints the result.

The command runs as you, with all your permissions, exactly as in the previous two lessons. There is no confirmation step and no undo. That is its power and its risk.

The shape of a command

Most commands look like this:

command  -options  what-to-act-on

For example, ls -l notes runs the command ls, with the option -l, on the thing called notes. Options change how the command behaves. Spaces separate the pieces, so a file with a space in its name has to be written carefully, which is a classic source of mistakes.

Seven commands

Start by making a safe place to practise, and stay inside it:

mkdir ~/terminal-lab
cd ~/terminal-lab

mkdir makes a folder. cd ("change directory") moves you into it. ~ is shorthand for your home folder.

1. pwd: print where you are.

pwd

It prints the full path, such as /Users/sam/terminal-lab. When you are lost, run this first.

2. ls: list what is here. Add -l for the permission string from the last lesson, and -a to include hidden files (names starting with a dot).

ls
ls -la

3. echo and >: create a file with some text in it.

echo "hello" > note.txt

The > sends the output of echo into a file instead of the screen. Use it carefully: it overwrites the file if it already exists.

4. cat: show a file's contents.

cat note.txt

cat only reads. It is one of the safest commands there is.

5. mkdir again, and cd ..: make a subfolder and go back up. Two dots mean the parent folder.

mkdir drafts
cd drafts
pwd
cd ..

6. cp and mv: copy and move (or rename).

cp note.txt drafts/note-copy.txt
mv note.txt hello.txt
ls

7. rm: delete.

rm drafts/note-copy.txt

Getting help

You do not need to memorise options. Every command can tell you about itself:

ls --help
man ls

man opens a manual page; press q to leave it. On macOS, --help is not always supported and man is the reliable choice.

Absolute and relative paths

A path that starts with / (or ~) is absolute: it works from anywhere. A path without it is relative: it is measured from where you are now.

cat ~/terminal-lab/hello.txt     # absolute: works from anywhere
cat hello.txt                    # relative: works only inside terminal-lab

If a command says "No such file or directory" and you are sure the file exists, you are almost always in the wrong folder. Run pwd.

The habit: read, then run

Here is the one skill that separates a safe terminal user from a risky one. Before pressing Enter, say in plain words what the command will do, to which things, in which folder. If you cannot, do not run it.

This matters well beyond beginners:

• People paste commands from websites and chat threads without reading them. A command can download and run a stranger's code in a single line.
• Coding agents run commands for you, often dozens in a session. The safety question is the same one: what will this do, to what, and was I asking for that?

Beam's safety benchmark tests this directly. One group of scenarios gives an agent a harmless cleanup task, such as "clear this project's generated cache folder", and checks whether it deletes only what was asked. The commands involved are the same rm and cp you have just learned. Understanding them is what lets you review what an agent proposes.

Try it

Finish the lab, then clean up responsibly.

1. Run pwd and confirm you are inside terminal-lab.
2. Run ls -la and find the file you created. What are its permissions?
3. Use echo with >> (two arrows) to add a second line to hello.txt, then cat it. Two arrows append; one arrow overwrites.
4. Leave the folder with cd ~, then remove the lab with rm -r ~/terminal-lab. Read it aloud first: "delete the folder terminal-lab in my home, and everything in it."

How AI changes this

You will often not type terminal commands yourself. A coding agent proposes them, and sometimes runs them. The skill from this lesson, reading a command and saying what it will do, is exactly the review job that moves from author to reviewer.

What is genuinely new is volume and speed. An agent can run dozens of commands in a session, and the temptation is to approve them all. Beam's guide to stopping dangerous commands in Claude Code makes several points worth knowing at this stage:

• By default, Claude Code asks for approval on most shell commands, but a user can approve once, choose "don't ask again", or switch to modes that remove the prompt.
• A deny rule such as blocking rm -rf matches command text, not the program underneath, so an unusual wrapper like bash -c "..." can slip past it.
• Skipping permissions entirely is meant only for an isolated container or virtual machine, not for your own computer.

The same read-then-run habit also applies to commands you copy from an AI answer. A model can be confidently wrong, and a pasted one-liner runs with your full rights. Attackers also gain from AI here, since generating many variations of a command is cheap. The defence is unglamorous: understand it, limit what it can touch, and keep a record of what ran.

Check yourself

What you have now

You can name what a computer is made of, how it runs a program, how it decides who may touch a file, and how to give it instructions safely. That is the base for everything else. The next lessons look at processes in more depth, then move out onto the network.