T03 · Remote Payload Retrieval and Execution
- Location
SKILL.md:16- Finding
Unverified Remote Installer Executed Directly by a Shell
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 16
Vulnerability Type: Remote payload retrieval and execution
Risk Level: HighVulnerable Code
bash curl -fsSL https://cli.inference.sh | sh && infsh loginTechnical Analysis
The Quick Start command downloads mutable content from
https://cli.inference.shand pipes it directly intosh. The remote response is therefore executed before the user can inspect it or independently verify its integrity.SKILL.mdstates that the installer selects a platform-specific binary and verifies its SHA-256 checksum. However, this does not establish the integrity of the installer itself, and the claim cannot be independently validated from the reviewed project. The installer URL and downloaded content are also not pinned to a reviewed version.Installation of the CLI is relevant to the Skill's declared video-generation functionality, and the documentation claims that elevated permissions and background processes are not used. Nevertheless, direct execution of a mutable remote script exceeds the minimum safe installation mechanism because the same objective can be achieved by separately downloading, inspecting, and verifying a version-pinned artifact before execution.
Attack Path
- An attacker compromises the installer host, its deployment pipeline, or another trusted component involved in serving
https://cli.inference.sh. - The attacker replaces or modifies the remote installer response.
- A user or agent follows the documented Quick Start command.
curlretrieves the attacker-controlled response.- The shell executes the response immediately with the privileges of the invoking account.
- The payload may access or modify any resources available to that account before installation continues, fails, or displays expected output.
Impact Assessment
Successful exploitation permits arbitrary command execution with the privileges of the user running the command. Potential ...[truncated 481 chars]
- An attacker compromises the installer host, its deployment pipeline, or another trusted component involved in serving
- Remediation
View remediation
Remediation Suggestions
- Remove the
curl | shinstallation pattern. - Provide a version-pinned download URL rather than a mutable installer endpoint.
- Download the artifact and checksum as separate files.
- Authenticate the checksum metadata, preferably using a signed release manifest from a separately protected trust channel.
- Verify the artifact locally before executing it, and abort on any mismatch.
- Display the exact artifact and version to be installed and require explicit user confirmation before execution.
- Prefer a reputable package manager or signed release mechanism with locked versions and provenance verification.
- If an installer script remains available, instruct users to save and inspect it before execution rather than piping it directly into a shell.
- Keep installation unprivileged and document the expected files, directories, network endpoints, and credential-storage behavior.
A safer documented flow would follow this pattern:
bash curl -fSLo infsh "<version-pinned-download-url>" curl -fSLo checksums.txt "<authenticated-version-pinned-checksum-url>" sha256sum --check checksums.txt chmod 0755 infsh ./infsh loginThe real implementation should ensure that the checksum entry is scoped to the downloaded platform artifact and that the checksum metadata is cryptographically authenticated.
- Remove the