Well it can't use text editor, so it would have to use echo 'rm -rf' with a shell redirection to a file, which would be detected.