building-clis

The code is ordinary release documentation with a potentially unsafe installer. It does not show clear malicious behavior, but curl-piped bash, unverified latest-release selection, lack of checksum/signature validation, and sudo installation create a meaningful supply-chain risk. Pin scripts or commits where practical, validate release metadata, verify signed checksums or attestations, and avoid executing unreviewed remote scripts.