twitter-digest

This is a remote-code bootstrapper with significant supply-chain risk characteristics: it clones and executes code from a configurable remote repository/tag, and on macOS it may additionally download and execute a remote shell script via curl in a Terminal automation flow. No direct malicious payload behavior (exfiltration/credential theft/reverse shells) is evident in this fragment alone, but the absence of integrity verification and the environment-controlled REPO/TAG parameters make it a high-impact installation vector. The effective malware/intent risk cannot be confirmed without inspecting the fetched `install.sh` and cloned `install.py` implementation.