He seems to be executing the "uptime" command. If that is not the only one he can (which most likely it isn't) it's bad.