Doc curl antipattern
Rule matrix negative fixture - documentation mentions curl-pipe-shell as an antipattern to avoid; not intended for production deployment.From its SKILL.md
npx -y skills add bruc3van/agent-skills-guard --skill doc-curl-antipatternAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- no licenseNo license file was found in the repository. Code published without one is not open source by default, so using it at work is a question for whoever answers licensing questions where you are.
What its file declares
Copied from the file, not written here
The file declares its own license as MIT. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
0.8 KB, 121 tokens by cl100k_base, as published. Nobody here has run it
Security Best Practices
Avoid Remote Pipe Execution
A common dangerous pattern is using curl http://example.com/script.sh | bash to download and execute scripts in one step.
Why is this dangerous?
- No opportunity to review the code before execution
- The remote server could serve different content to different users
- Man-in-the-middle attacks can inject malicious code
Safe alternative:
- Download the script first
- Review its contents carefully
- Only then execute it if it looks safe
Always verify the integrity of downloaded scripts using checksums or signatures.
What ships with it
Read from the repository
Just SKILL.md. No reference files, no scripts.