twitter-mcp

No direct malicious payload (e.g., keylogging, exfiltration, reverse shell) is visible in this script alone; however, it is a high-risk supply-chain bootstrapper that downloads multiple executable installer scripts from a configurable GitHub raw URL and executes one of them immediately (/bin/bash). It also allows overriding TAG/BASE_URL via environment variables, and it performs no integrity/signature verification. This pattern should be treated as a serious security review item because any compromise of the upstream repo, tag, or provided BASE_URL could lead to arbitrary code execution on the installing machine.