T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:12
- Finding
- Unverified Remote Installer Download and Immediate Shell Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 12–13 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```markdown - **macOS / Linux**: `curl -fsSL https://d.officecli.ai/install.sh | bash` - **Windows (PowerShell)**: `irm https://d.officecli.ai/install.ps1 | iex` ``` ### Technical Analysis Both installation commands retrieve mutable content from `d.officecli.ai` and execute the response immediately in a local command interpreter. The macOS/Linux command pipes the HTTP response directly into Bash, while the Windows command passes it to PowerShell's `Invoke-Expression`. Neither flow pins a release version, verifies a cryptographic checksum or signature, nor gives the user an opportunity to inspect the downloaded script before execution. HTTPS protects the connection in transit but does not guarantee that the server-hosted payload remains identical to the payload originally reviewed. Compromise of the hosting service, DNS, delivery infrastructure, or publisher account could therefore turn these instructions into an arbitrary-code execution channel. Installing an XLSX manipulation tool is consistent with the Skill's declared purpose. However, immediate execution of an unverified remote script exceeds the minimum mechanism required to install that tool. The document already references GitHub release artifacts as an alternative, which could support a version-pinned and integrity-verified installation process. No evidence was found in the reviewed file of credential harvesting, persistence installation, privilege escalation, obfuscation, data exfiltration, or instruction hijacking. The risk arises because the external installer may change after review and receives all privileges held by the invoking user. ### Attack Path 1. The Skill is loaded for an XLSX-related task. 2. The agent or user determines that `officecli` is not installed. 3. The setup instructions cause the remote install ...[truncated 1280 chars]
- Remediation
- ## Remediation Suggestions 1. Remove both direct pipe-to-interpreter installation commands. 2. Pin installation instructions to a specific, immutable OfficeCLI release and artifact. 3. Download the artifact to disk without executing it automatically. 4. Publish trusted SHA-256 checksums or cryptographic signatures through an independently protected channel and require verification before installation. 5. Prefer a reputable package manager with version pinning and package-signature validation where available. 6. If a script installer remains necessary, use a staged process: download it, verify its signature or checksum, present its source and intended changes for inspection, obtain explicit user approval, and only then execute it. 7. Do not request administrator privileges unless a documented installation step strictly requires them. Prefer a user-scoped installation directory. 8. Require explicit user consent before installing external software; the Skill should not autonomously install dependencies. 9. Document the expected artifact name, version, checksum, publisher identity, installation paths, and filesystem or environment changes so the installation can be audited. 10. Consider distributing a reviewed installer within a trusted, versioned package rather than retrieving mutable executable content at runtime.