Is sigma-terminal safe to install?

sigma-terminal was flagged as CRITICAL RISK (risk score 478) with 48 findings detected across 69 files. Review the findings before installing.

What security issues were found in sigma-terminal?

Sigil detected 48 findings in sigma-terminal, including patterns related to provenance, code_patterns, network_exfil, install_hooks. See the full scan report for details.

Scans/pypi/sigma-terminal

sigma-terminal

pypi

Summary

sigma-terminal v3.7.0 was classified as CRITICAL RISK with a risk score of 478. Sigil detected 48 findings across 69 files, covering phases including provenance, code patterns, network exfiltration, install hooks. Review the findings below before installing this package.

Package description: Sigma - Finance Research Agent

CRITICAL RISK(478)

v3.7.0

21 March 2026, 23:58 UTC

by Sigil Bot

Risk Score

478

Findings

Files Scanned

Provenance

Registry

https://pypi.org/project/sigma-terminal/3.7.0/

Findings by Phase

•

Phase Ordering

Phases are ordered by criticality, with the most dangerous at the top. Click any phase header to expand or collapse its findings. Critical phases are expanded by default.

install-makefile-curl

HIGH

Makefile/script pipes remote content to shell

sigma_terminal-3.7.0/sigma/setup_agent.py:108

                    # Use curl | sh as requested
                    install_cmd = "curl -fsSL https://ollama.com/install.sh | sh"
                    subprocess.run(install_cmd, shell=True, check=True)

Why was this flagged?

A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.

Badge

Markdown

[![Sigil Scan](https://sigilsec.ai/badge/pypi/sigma-terminal)](https://sigilsec.ai/scans/A8C783FC-0C6B-4D55-8FBA-0E450D51A9EE)

HTML

<a href="https://sigilsec.ai/scans/A8C783FC-0C6B-4D55-8FBA-0E450D51A9EE"><img src="https://sigilsec.ai/badge/pypi/sigma-terminal" alt="Sigil Scan"></a>

Run This Scan Yourself