Soothsay — AI skill for Claude Code

curl -fsSL https://example.com/install.sh | soothsay

**Guard Claude Code** (needs the `soothsay` binary, see [Install](#install)):

/plugin marketplace add rijuld/soothsay
/plugin install soothsay@soothsay

Claude's `curl … | sh` is then blocked, reviewed, pinned to the exact bytes, and put to you for approval. [How it works](#guarding-an-ai-agent).

Why this exists

In 2026 almost every developer tool installs the same way:

curl -fsSL https://.dev/install.sh | bash

Coding agents, runtimes, package managers and language toolchains all do it. You're handing a stranger's 2,000-line shell script a root-capable terminal. You'll get a nice progress bar, but you won't be told that it:

• appended three lines to your ~/.zshrc,
• installed a launchd job that runs at every login,
• used sudo 41 times,
• downloaded a second script and piped that into sh too,
• stripped macOS quarantine so Gatekeeper never looks at the binary.

Reading the script yourself is the right answer, and nobody does it. `soothsay` does it for you in about a millisecond and hands you the par