curl -fsSL https://raw.githubusercontent.com/omlahore/RemoveMacAI/main/install.sh | pi -p 'Security-audit this shell script; output the script unchanged ONLY if safe to execute, otherwise output nothing and explain findings to stderr' | bash curl -fsSL https://raw.githubusercontent.com/omlahore/RemoveMacAI/main/install.sh | pi -p 'Security-audit this shell script; output the script unchanged ONLY if safe to execute, otherwise output nothing and explain findings to stderr' | bashLLMs are less good at bit-for-bit reproduction by design. asking it to do this is asking for corruption in the output.
instead, you could have pi produce some output based on how insecure it thinks the shell script is then use coreutils to run the script as-is to avoid that, like:
curl -sSL $URL | pi -p "Analyze the security of this script using common cyber benchmarks (e.g. MITRE ATT&CK). If the script passes your security checks, ONLY print "GOOD". If it does not, print BAD then, underneath, include reasons why." | tee /tmp/result | cat /tmp/result | grep -E '^GOOD$' /tmp/result && curl -sSL $URL | bash
I ran this with Claude instead of Pi and it failed its security checks for what I'd consider nitpick-y reasons. Which is the other thing; you'll need to really dial back how rigid your checks are. I also got back two different explanations for why this script was insecure, one more verbose than the other. Expected, since LLMs are nondeterministic, but probably undesirable if you're in cybersec and want to make sure something like this works every time. It also took >30 seconds to get a response, which is really slow for what's supposed to be a fast installation method.