CheckBot: Update upstream scripts

[hustcer]

This PR updates the upstream scripts to the latest revision.

[github-actions]

Script Analysis

• The diff shows changes to PowerShell and Unix shell scripts that create a moonx executable as a hard link (Windows) or symlink (Unix) to the main moon executable
• These are traditional shell scripts, not Nushell scripts, so Nu-specific features don't apply directly
• The changes appear to be part of a MoonBit language toolchain installation process
• The Unix script uses ln -sfn which is a GNU-specific flag; may not work on macOS/BSD systems

Security Review

• ❌ Command injection risk: The Unix script uses $bin_dir/moonx without quoting, which could lead to path injection if $bin_dir contains spaces or special characters
• ❌ Unsafe removal pattern: rm -rf "${moon_home:?}/include" uses the ${var:?} safety pattern, but the new ln command doesn't have similar safeguards
• ⚠️ Race condition: The PowerShell script removes $MoonxExe then creates a hard link, but there's a TOCTOU (time-of-check-time-of-use) vulnerability between the Test-Path and Remove-Item operations
• ⚠️ No validation: Neither script validates that $MoonExe/moon actually exists before creating the link, which could create dangling references
• ⚠️ Privilege escalation potential: If $MoonBin is writable by non-privileged users, an attacker could replace the target before the link is created

Optimization Suggestions

• Use atomic operations: Replace the separate remove+create with a single force operation to avoid race conditions
• Add existence checks: Validate the source executable exists before creating links
• Improve cross-platform compatibility: The Unix ln -sfn flag -n (no dereference) is GNU-specific; consider using -sf for broader compatibility or add a fallback
• Quote all variables: In the Unix script, quote "$bin_dir/moonx" to prevent word splitting
• Consider error handling: The PowerShell script uses | Out-Null which suppresses errors; consider using -ErrorAction Stop for better error propagation

Overall Quality: 2/5
The changes introduce functional improvements but have significant security concerns including command injection vectors, race conditions, and lack of input validation. The cross-platform compatibility issues could cause silent failures on macOS systems.