one-line-installer-patterns
Pass
Audited by Gen Agent Trust Hub on Sep 5, 2026
Risk Level: SAFEREMOTE_CODE_EXECUTIONCOMMAND_EXECUTION
Full Analysis
- [Remote Code Execution Patterns]: The skill documents the community convention of
curl -fsSL [URL] | bash. This is a documented security consideration because it executes remote content directly in a shell. However, the skill provides these as design examples for developers and includes a thorough section on 'The security trade-off, stated honestly' and 'Required mitigations' (such as HTTPS-only, script pinning, and signature verification). - [Documentation of Third-Party Installers]: The skill lists several well-known and trusted installer URLs (such as those from Deno, Bun, Rustup, and Ollama) as reference material. These are used to illustrate industry standards and do not represent a threat in this context.
- [Command Execution Guidance]: The skill provides instructions on how to write robust shell scripts (using
set -euo pipefail,mktemp, etc.) to minimize errors and side effects during software installation. This is a best-practice guide for developers rather than a functional script intended for the agent to run.
Audit Metadata