Unless there's a bug in curl, jq or sed that leads to an RCE, which is what my point was.