T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:16
- Finding
- Remote Installer Is Executed Directly Without Local Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:16` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The command downloads mutable content from `https://cli.inference.sh` and passes it directly to a shell. The project does not pin an installer version, verify a repository-pinned checksum or signature before execution, or provide a locally auditable installer. Although `SKILL.md` claims that the installer only detects the operating system and architecture, downloads a matching binary, and verifies its checksum, that assertion cannot be verified from the audited project. A checksum obtained or selected by the same mutable remote infrastructure does not independently protect against compromise of that infrastructure. Executing an arbitrary remote shell response exceeds the minimum privileges required to install a known CLI binary. The payload receives all permissions available to the user running the command. ### Attack Path 1. A user follows the documented Quick Start command. 2. The host serving `cli.inference.sh`, its deployment credentials, or another component of the delivery path is compromised. 3. The server returns a modified shell script instead of the expected installer. 4. `curl` streams the response directly into `sh` without allowing local inspection or independent integrity verification. 5. The malicious script executes with the invoking user's privileges. 6. The payload can access user-readable data, alter user-writable files, install persistence where permitted, or monitor the subsequent `infsh login` process and authentication state. ### Impact Assessment Successful exploitation provides arbitrary command execution with the invoking user's effective privileges. Depending on those privileges, the payload could: - Read or modify files accessible to the user. - Steal environm ...[truncated 497 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` installation pattern. 2. Pin the CLI to an explicit, immutable version. 3. Download the binary and integrity metadata as separate files. 4. Verify the binary against a SHA-256 digest stored in the reviewed Skill or validate a signature rooted in a separately trusted public key. 5. Abort installation if integrity or signature verification fails. 6. Display the exact download URL, installation destination, and permissions to the user before installation. 7. Avoid administrator privileges and install into a user-controlled directory with minimal permissions. 8. Keep authentication as a separate, explicit command after installation so it cannot run following an unverified installer. A safer documented workflow should resemble: ```bash curl -fL -o infsh "<version-pinned-binary-url>" printf '%s %s\n' "<reviewed-sha256>" "infsh" | sha256sum -c - install -m 0755 infsh "$HOME/.local/bin/infsh" infsh login ``` The digest must come from an independently trusted, immutable source rather than being dynamically accepted from the same mutable endpoint. ]]>