T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:16
- Finding
- Remote Installer Is Downloaded and Executed Without Prior Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16` **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The command pipes mutable content retrieved from `https://cli.inference.sh` directly into `sh`. The downloaded installer is therefore executed before the user or agent can inspect it or independently verify its integrity. The installation note at line 21 claims that the installer downloads an architecture-specific binary and verifies its SHA-256 checksum. However, this does not authenticate the installer itself. If the distribution origin, DNS/TLS trust chain, hosting infrastructure, or installer script is compromised, the script can replace the expected checksum, omit verification, or execute an unrelated payload. Direct remote execution is not required for the Skill's declared image-generation functionality. A manually downloaded, version-pinned, and independently verified CLI would provide the needed functionality with lower supply-chain risk. ### Attack Path 1. A user or agent loads the Skill and follows its Quick Start instructions. 2. `curl` retrieves the current contents of `https://cli.inference.sh`. 3. The remote service, hosting environment, or delivery path has been compromised, or the mutable script has otherwise been replaced. 4. The response is passed directly to `sh` without local inspection or pre-execution verification. 5. The substituted payload executes with all permissions available to the invoking user or agent. 6. The payload can read or modify accessible files, credentials, agent configuration, and user-installed executables, or retrieve and launch additional components. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking account. The command does not explicitly request elevated privileges, so root-level ac ...[truncated 453 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` installation pattern. 2. Publish versioned CLI artifacts and require an explicit, version-pinned download. 3. Publish SHA-256 checksums or cryptographic signatures through a trusted channel independent of the artifact host. 4. Download the artifact to a local file before executing or installing it. 5. Verify its signature or checksum locally and abort on any mismatch. 6. Provide manual inspection and installation steps, including the exact destination and permissions used. 7. Avoid elevated privileges and install the CLI into a user-controlled directory with minimal permissions. 8. Pin the expected installer or binary version so reviewed behavior cannot silently change. A safer workflow would separate download, verification, installation, and authentication into distinct commands. ]]>