Even the official Steam launcher script from Valve had an rm -rf command with a variable that resolved into empty. This deleted everything in the users home directory. Valve corrected the script afterwards. Here is a random blog post about this subject I just found: hackaday.com/…/how-a-steam-bug-once-deleted-all-o…