T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:254
- Finding
- Unverified Remote Installer Is Piped Directly into a Shell## Vulnerability Details **File Location**: `SKILL.md:254` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable code:** ```bash curl -fsSL https://ollama.com/install.sh | sh ``` ### Technical Analysis The setup instructions download a mutable shell script from an external URL and execute it immediately. The command provides no version pinning, checksum verification, cryptographic signature validation, or opportunity to inspect the downloaded content before execution. HTTPS protects the connection in transit under normal conditions, but it does not establish that the remote script is immutable or safe. If the Ollama website, hosting infrastructure, DNS resolution, certificate trust path, or release process is compromised, the command could deliver arbitrary attacker-controlled shell commands. Ollama supports the skill's documented local OCR and embedding mode, but piping its installer directly into a shell is not required for that functionality. The documentation also provides a full-cloud mode that does not require Ollama. A package-manager installation or separately downloaded and verified artifact would meet the functional requirement with less risk and better adherence to least privilege. ### Attack Path 1. An attacker compromises the remote installer, its hosting infrastructure, or another trusted part of its delivery path. 2. The attacker modifies the response served from `https://ollama.com/install.sh` to include malicious shell commands. 3. A user follows the installation instructions in `SKILL.md`. 4. `curl` retrieves the current attacker-controlled response. 5. The pipe sends the response directly to `sh`, without integrity verification or review. 6. The malicious commands execute with the privileges of the user running the setup command. 7. The payload can access resources available to that user and may attempt further privilege escalation or persistence, although ...[truncated 1023 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `curl | sh` pipeline from the setup instructions. 2. Prefer an official operating-system package manager and pin an explicit Ollama version where supported. 3. If a standalone installer is necessary: - Download it to a local file as a separate step. - Use a version-specific, immutable release URL. - Obtain the expected checksum or signature through an authenticated release channel. - Verify the artifact before execution. - Inspect the script and execute it only after successful verification. 4. Document the permissions and filesystem changes required by the installer, and advise users to avoid running the entire setup as `root`. 5. Fail closed when verification cannot be completed; do not continue with an unverified artifact. 6. For reproducible installation, pin Python dependencies and publish lock files or hash-verified requirements for the externally referenced implementation. 7. Retain the documented full-cloud mode as an alternative for users who do not need or trust the local Ollama installation path. A safer pattern is: ```bash curl -fL --output ollama-install.sh \ https://example.invalid/versioned/ollama-install.sh echo "EXPECTED_SHA256 ollama-install.sh" | sha256sum --check - less ollama-install.sh sh ollama-install.sh ``` The placeholder URL and checksum must be replaced with a versioned official release artifact and its independently published expected digest.