T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:16
- Finding
- Unpinned Remote Installer Is Executed Directly by a Shell## Vulnerability Details **File Location**: `SKILL.md`, line 16 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The installation command streams a mutable response from `https://cli.inference.sh` directly into `sh`. The downloaded installer is neither saved for inspection nor pinned to a specific immutable version or digest before execution. The document states that the installer verifies the SHA-256 checksum of the CLI binary. However, that does not establish the integrity of the installer itself: the remote script must execute before it can perform the claimed binary verification. HTTPS protects the connection in transit but does not protect against compromise of the hosting service, deployment pipeline, domain, or publishing account. This behavior is not necessary for the Skill's declared content-pipeline functionality. A manually downloaded, version-pinned, independently verified CLI binary would provide the required functionality with less supply-chain exposure. The behavior also grants the remote endpoint substantially broader authority than the declared `infsh` command usage requires. ### Attack Path 1. An attacker compromises or gains control over the installer endpoint, its publishing pipeline, or an equivalent trusted delivery component. 2. The attacker changes the response from `https://cli.inference.sh` to include arbitrary shell commands. 3. A user or automation agent follows the documented Quick Start command. 4. `curl` streams the attacker-controlled response directly to `sh`. 5. The payload executes immediately with the privileges and environment of the invoking user. 6. The payload can access resources available to that user before optionally installing the legitimate CLI to conceal the compromise. ### Impact Assessment Successful exploitation ...[truncated 651 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `curl | sh` installation pattern. 2. Link to a specific, immutable CLI release rather than a mutable installer endpoint. 3. Require users to download the release artifact without executing it: ```bash curl -fL -o infsh https://example.invalid/releases/<fixed-version>/infsh-<platform> ``` 4. Publish the expected SHA-256 digest through an independently protected release channel and require verification before installation: ```bash echo '<expected-sha256> infsh' | sha256sum -c - ``` 5. Document manual installation into a user-owned directory without `sudo`. 6. Where supported, provide signed release artifacts and document signature verification. 7. Separate installation from authentication so that users can inspect and verify the installed binary before running `infsh login`. 8. Advise users to perform installation in a restricted, non-administrative environment.