Do you mean curl | cat or do you really want to create a file called cat?

Also piping to cat seems redundant but malicious hosts can detect whether the request is getting redirected, using some clever trick, so it’s not.

Also, your chance of spotting something bad in a malicious script is probably quite small.