Yah I follow a similar approach in addition to doing a simple search for well known malicious commands like rm -rf / and some others as well.