The Agent Skills Directory

[REMOTE_CODE_EXECUTION]: The skill's documentation and reference files (SKILL.md, references/online-install-bootstrap.md) explicitly promote a 'curl piped to bash' installation pattern (curl -fsSL https://.../install.sh | bash). This method executes remote scripts directly in the shell without prior user inspection, representing a high-risk execution vector.
[COMMAND_EXECUTION]: The Go implementation in src/internal/release/version.go dynamically constructs shell commands and bootstrap scripts by interpolating variables such as repository names, version tags, and file paths. These values are derived from command-line flags parsed in src/internal/app/app.go and are not sufficiently sanitized for shell metacharacters, creating a command injection vulnerability where untrusted input could manipulate the generated script's behavior.
[EXTERNAL_DOWNLOADS]: The installer is designed to fetch pre-built binaries and checksum files from external GitHub releases (src/internal/release/download.go). While the tool implements checksum verification, the automated download-and-execute workflow facilitates the introduction of external executable code into the local system environment.

gomtm-installer