manage-agent

This wrapper itself does not show direct malware behavior, but it implements high-risk software supply-chain behavior: it downloads an unpinned remote installer script from a raw GitHub URL and executes it immediately via `curl | sh` with no integrity/signature verification. This creates a significant risk of arbitrary code execution if upstream content changes or is compromised. Mitigation: pin to an exact commit/tag, verify checksums or signatures, and avoid executing remote scripts directly (or use a vetted package manager/installer with provenance).