Harden cli-hub: registry `install_cmd` strings are shell-executed (unpinned `curl | bash` from third-party hosts)

[amaniagent]

Thanks for CLI-Anything — the registry-driven installer model is neat. While reading the install path I noticed a supply-chain hardening opportunity worth raising.

cli-hub/cli_hub/installer.py (_run_command) executes a registry entry's install_cmd with shell=True when it contains a pipe/operator, and the registry ships entries whose install_cmd is an unpinned remote script — e.g. in public_registry.json:

"install_strategy": "command",
"install_cmd": "curl -s https://jimeng.jianying.com/cli | bash"

Because the command is fetched-then-piped-to-bash with no version pin or checksum, the safety of an install reduces entirely to "is this registry entry (and the host it points at) trustworthy right now?" A malicious or compromised registry entry — or a hijacked third-party host — becomes arbitrary code execution on the installing user's machine.

This shape is inherent to any "run the install command" tool (Homebrew casks have the same trait), so it isn't a bug — but a few guardrails would shrink the blast radius:

• Show the exact command and require explicit confirmation before executing a script/command-type entry (interactive y/N, with a --yes to opt out for automation).
• Prefer non-script install_strategy (package managers with lockfiles/signatures) where an upstream offers one; treat curl | bash as the last resort.
• Pin + checksum: let registry entries carry an expected SHA for the fetched script and verify before running.
• Optionally surface in the registry schema which entries are remote-script installs so consumers can filter/trust accordingly.

Happy to send a PR for the confirm-before-exec piece if that'd be welcome.

_{Surfaced via a static, read-only audit of supply-chain install patterns — no code was executed. Happy to clarify anything.}

[MianliWang]

Fixed in #388.

The fix closes the registry-command execution path rather than treating the Jimeng bootstrap hash as end-to-end proof:

• Free-form registry commands now display the exact escaped command and require default-No confirmation.
• Non-interactive and JSON callers fail closed unless they explicitly use --yes.
• The same guard now covers install, update, uninstall, and matrix-install commands.
• The public Jimeng entry no longer contains an executable curl | bash command. It is marked manual, and CLI-Hub presents the official instructions plus audited bootstrap metadata instead of executing it.
• The registry/OpenAPI model now records remote-script URL, SHA-256, interpreter, and the integrity scope.
• Jimeng remains manual because the official bootstrap script fetches additional mutable binaries without upstream-published checksums; validating only the bootstrap script would not ensure end-to-end integrity.

Validation performed:

• focused security/install/matrix regression suite: 59 passed;
• full related suite: 163 passed, with 24 pre-existing Windows-only baseline failures unrelated to this change;
• static audit: zero public install_cmd entries matching a remote-script pipe pattern;
• re-fetched the official Jimeng bootstrap and re-verified the recorded SHA-256 (3d9a5cade9c94420b13c46f1a425d657e22225c926b06a4608eae32065d7e158, 12,497 bytes).