remarkable-sync

clawhub:remarkable-sync

View source
B
85/100

First Seen

Feb 18, 2026

Last Scanned

Feb 22, 2026

Findings

1

Score

85/100

HIGH 1

Findings (1)

HIGH
Binary download and execute
L55

Detects downloading a binary file followed by making it executable

curl -L https://github.com/ddvk/rmapi/releases/latest/download + chmod +x
FIX

Pin the download to a specific version tag or commit hash. Verify the downloaded file's checksum before using it. Avoid piping curl output directly to a shell.

FP?

Likely FP if downloading from an official, well-known domain (e.g., deno.land, rustup.rs) with HTTPS, though this pattern remains risky even with trusted sources.