Why It Matters

SEC313 flags fenced shell examples that pipe remote content directly into a shell, such as curl ... | sh.

This is different from SEC102: here the risky pattern appears in an explicit shell example block. That makes the intent more clearly demonstrative, but it is still copy-pastable setup guidance.

Positioning

This is a context-sensitive threat-review rule. It is more precise than prose-only download-exec guidance, but fenced examples in docs can still be intentionally educational rather than operationally endorsed.

What Triggers

SEC313 applies to fenced bash, sh, shell, or zsh blocks. It triggers when a line inside the fenced block contains a remote download-and-execute pattern.

Example that triggers:

curl -L https://example.test/install.sh | sh

Examples that stay clean:

• the same text outside a fenced shell block
• fenced blocks that do not pipe remote content into a shell
• non-shell fenced blocks such as generic text or JSON examples

False Positives

This rule now lives in threat-review because shell examples in docs can be intentionally educational, especially in setup guides and training repos, while the direct pipe-to-shell behavior is still too forceful for the softer preview lane. The finding is still useful as a hardening signal, but it is guidance-first rather than proof of a bad runtime configuration.

Remediation

Prefer a reviewed install flow that downloads to a file first, verifies provenance, or uses a published package manager path instead of piping remote content straight into a shell.