T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:16
- Finding
- Remote Installer Executed Through a curl-to-shell Pipeline## Vulnerability Details **File Location**: `SKILL.md`, line 16 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The Quick Start instructions download a mutable script from `https://cli.inference.sh` and pipe it directly to `sh`. The script is executed before the user can inspect it, pin its version, or independently verify its integrity. The documentation states that the installer verifies the SHA-256 checksum of the binary it subsequently downloads. This does not establish the integrity of the bootstrap script itself because that script remains remotely controlled and can change after the Skill has been reviewed. HTTPS provides transport protection but does not mitigate compromise of the hosting infrastructure, publishing account, DNS/TLS trust path, or installer generation process. Installing a CLI is relevant to the declared functionality, but executing mutable remote shell code is not the minimum privilege or safest installation method necessary to provide FLUX image generation. ### Attack Path 1. An attacker compromises the remote installer host, its deployment pipeline, publishing credentials, or another part of the trusted delivery path. 2. The attacker modifies the script returned by `https://cli.inference.sh`. 3. A user follows the documented Quick Start command. 4. `curl` retrieves the attacker-controlled content and passes it directly to `sh`. 5. The payload executes with all permissions of the user running the command. 6. The payload may access user-readable files, alter shell configuration, install additional programs, or intercept the subsequent `infsh login` process. ### Impact Assessment Successful exploitation permits arbitrary command execution under the invoking user's account. The accessible scope may include project files, ...[truncated 314 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the pipe-to-shell installation command from the Quick Start instructions. 2. Direct users to download a version-pinned binary from an immutable release URL. 3. Publish a trusted SHA-256 digest or, preferably, a cryptographic signature for each release. 4. Require users to verify the downloaded artifact before executing or installing it. 5. Pin the installer and CLI to an explicit version rather than using a mutable endpoint. 6. Document a nonprivileged installation directory and explicitly advise users not to run installation commands as root. 7. If an installation script remains available, instruct users to download it as a file, inspect it, verify its signature or pinned digest, and only then execute it. 8. Keep authentication separate from installation so a compromised installer cannot seamlessly lead users into entering credentials.