T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:16
- Finding
- Mutable Remote Installer Is Piped Directly into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 16 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The Quick Start command downloads content from `https://cli.inference.sh` and passes it directly to `sh`. The effective installer is mutable remote content that is neither included in the audited project nor pinned to a reviewed version. It is executed before users can inspect it or independently verify its integrity. The documentation states that the remote installer verifies the SHA-256 checksum of the binary it subsequently downloads. That does not authenticate the installer script itself. A compromised domain, CDN, publication pipeline, DNS/TLS path, or server could return a modified script that executes arbitrary commands before or instead of performing the claimed checksum verification. Installing a CLI is relevant to the Skill's functionality, but executing unaudited remote shell content is not the minimum privilege or safest mechanism necessary to perform that installation. ### Attack Path 1. An attacker compromises the remote installer hosting infrastructure, deployment credentials, CDN, or another component capable of changing the response from `cli.inference.sh`. 2. The attacker replaces the installer response with a malicious shell payload. 3. A user follows the documented Quick Start command. 4. `curl` retrieves the attacker-controlled response and streams it directly into `sh`. 5. The payload executes immediately with all permissions available to the invoking user. 6. The payload can access user-readable files, environment variables, credentials, network resources, and writable configuration locations. ### Impact Assessment Successful exploitation provides arbitrary command execution in the security context of the user running the installation command. This m ...[truncated 532 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` installation workflow. 2. Publish versioned CLI artifacts through an official release channel and require users to select an explicit version. 3. Download the artifact to a local file without executing it automatically. 4. Publish a fixed SHA-256 or stronger cryptographic digest through an independently trusted channel. 5. Verify the downloaded artifact locally before execution. 6. Prefer cryptographically signed releases and verify the signature against a documented, pinned public key. 7. Provide manual installation instructions that disclose all files, permissions, and configuration changes. 8. Ensure installation runs with ordinary user privileges and explicitly warn users not to invoke it as root or through `sudo`. 9. If an installer script remains necessary, version and include it in the reviewed package rather than retrieving mutable code at execution time. ]]>