External Script Fetching
- Category
- Supply Chain
- Confidence
- 99% confidence
- Finding
The
curl ... | bashpattern causes immediate execution of unreviewed code from a remote server, creating a direct remote code execution risk for users following the documentation. In a developer tooling guide, this is especially dangerous because it normalizes unsafe installation behavior on workstations that may also hold source code and credentials.- Content
md ### Installation - Windows: `iwr -useb https://openclaw.ai/install.ps1 | iex` or `npm install -g openclaw@latest` (requires Node.js 22+) - macOS/Linux: `curl -fsSL https://openclaw.ai/install.sh | bash` or `npm install -g openclaw@latest` ### Configure MaaS API
