deploy-coolify-cloud

The script has a legitimate token-setup purpose, but unsafe generation of a sourced shell file creates an injection risk, and the configurable API destination can expose the token if set incorrectly or maliciously. Quote and escape values when writing the file, and validate the base URL against an expected trusted host or require explicit confirmation for other hosts.

No overt in-script malware behavior is present (no eval/exec of remote text, no credential handling, no exfiltration, no persistence beyond installing the CLI binary). However, the script performs a high-impact supply-chain action: it downloads and installs an unverified remote executable from a release artifact without checksum/signature validation, and it extracts an untrusted tarball without additional safety checks. The primary risk is that a compromised release artifact (or equivalent supply-chain compromise) would result in the user running a malicious CLI installed by this script.