Comment by Izmaki

Not to mention that a webserver can be configured to show one sh file when a regular browser visits and another when curl etc. gets it. Show one thing, install another.