plannotator

This installer script contains no clear indicators of built-in malware (no visible credential theft, data exfiltration, persistence, or obfuscated payloads in the shown code). However, it performs high-risk supply-chain execution by piping a remotely fetched installer directly into `bash` without integrity checks, and it delegates further privileged actions to additional local setup scripts whose contents are not present here. Treat this as a significant supply-chain risk until the remote installer and invoked setup-*.sh scripts are reviewed and verified (e.g., via checksums/signatures and provenance).