task-tracking-dots-html

No direct malicious logic is visible in the shell wrapper itself (it primarily performs install/build and runs --version). However, it carries substantial supply-chain integrity risk: it downloads and executes a prebuilt binary from a GitHub 'latest' release without checksum/signature verification, and it falls back to cloning and building unpinned remote source (default branch/HEAD snapshot). If the upstream release or repository is compromised, this script would plausibly install and execute a malicious payload. Recommend adding artifact integrity verification (pinned hashes/signatures) and pinning source commits/tags before build.