# Remote script piped to a shell

A Dockerfile RUN instruction that downloads a script with curl or wget and pipes it to sh or bash.

Area: Security

## What you need to supply

The Dockerfile text. The check does not fetch the remote script.

## If it reports a finding

High severity. The suggested next step is to download the script, review it, and pin a checksum before running it.

## What this does not prove

A download that is saved to a file and not piped to a shell is not this finding.

## Instruction that this check is written to notice

```
RUN curl -fsSL https://example.com/install.sh | bash
```

Reading this page does not submit infrastructure. The HTML page is https://skaleagents.com/checks/remote-script-piped-to-a-shell.