intent-cli

No clear evidence of stealth/backdoor behavior, credential harvesting, cryptomining, or data exfiltration is present in this fragment. However, the script performs the inherently high-risk act of executing code from a network-fetched repository and from a built bundle (build-release.sh and remote-release.sh). While it attempts supply-chain safety via strict SHA pinning, directory/symlink checks, a fail-closed lock, and release_manifest.py verification, the security still fundamentally depends on the correctness and robustness of release_manifest.py and the trust boundary around remote-release.sh. As provided, malware likelihood is low, but security risk is moderate due to executed untrusted artifact code.