Remote Script Piped Into a Shell

Why it matters

Piping a download into sh means the install step depends on a server you do not control being correct and unchanged on every build. Using the package manager, or downloading a pinned release and checking its checksum, gives the same result and a build that behaves the same way every time.

What it looks like

This is the shape of code that triggers the rule. AI tools produce it because it works, and nothing tells them it is unsafe.

RUN curl -fsSL https://get.example.com/install.sh | sh

The smallest fix

# Before
RUN curl -fsSL https://get.example.com/install.sh | sh
# After: pinned release with a checksum
RUN curl -fsSLo /tmp/tool.tar.gz https://github.com/org/tool/releases/download/v1.2.3/tool-linux-amd64.tar.gz \
 && echo "<sha256>  /tmp/tool.tar.gz" | sha256sum -c - \
 && tar -xzf /tmp/tool.tar.gz -C /usr/local/bin

The better fix

If you have a few more minutes, this is the approach that holds up as the app grows.

# Prefer a base image that already includes the tool, or the distro
# package manager (apt-get install --no-install-recommends <pkg>=<version>).

Let your AI tool fix it

When the scanner finds this in your project, it fills in the file and line for you. This is the prompt it gives you to paste into Claude Code, Cursor or whatever you use.

How to check the fix worked

1. Rebuild the image and confirm the tool is installed at the pinned
   version.
2. Change one byte of the expected checksum and confirm the build fails.

Further reading

• https://cwe.mitre.org/data/definitions/494.html