T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:14
- Finding
- Mutable Remote Installer Is Piped Directly Into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14` **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The Quick Start retrieves a shell script from a mutable external URL and passes the response directly to `sh`. The script therefore executes before the user can inspect or independently authenticate its contents. TLS protects the connection in transit but does not mitigate a compromised hosting service, domain or DNS takeover, malicious upstream update, or unauthorized modification of the installer. The document claims that the installer verifies the downloaded binary's SHA-256 checksum, but that does not authenticate the installer itself. A compromised installer could bypass its advertised verification process or execute unrelated commands. Installing a CLI may support the Skill's declared screenshot-generation functionality, but immediate `curl | sh` execution is unnecessary. The same document identifies manual installation and verification as an available, less risky alternative. ### Attack Path 1. A user follows the Quick Start command. 2. An attacker compromises or gains control over `cli.inference.sh` or its delivery infrastructure. 3. The endpoint returns an altered shell script. 4. `curl` streams the response directly into `sh`. 5. The malicious commands execute immediately with the invoking user's privileges. 6. The payload can access the user's files and credentials, alter local configuration, or retrieve additional payloads. ### Impact Assessment The remote endpoint effectively receives arbitrary command execution under the account that invokes the installation command. Potential access includes all files, credentials, environment variables, authentication tokens, and configuration writable or readable by that user. The command does not explicitly request elevated privile ...[truncated 327 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl | sh` pipeline. 2. Publish versioned installer artifacts at immutable URLs. 3. Pin the installation instructions to a specific audited release. 4. Download the artifact without executing it: ```bash curl -fL -o infsh.tar.gz https://example.invalid/releases/vX.Y.Z/infsh.tar.gz ``` 5. Publish the expected SHA-256 digest through a separately authenticated release channel and require users to compare against that pinned value before installation. 6. Prefer cryptographic signature verification using a documented, pinned public key. A checksum downloaded from the same potentially compromised endpoint is insufficient by itself. 7. Extract and install only after successful verification, without invoking unnecessary elevated privileges. 8. Document the destination paths, files created, network endpoints used, and uninstall procedure. 9. If a shell installer remains available, present it only as a separately downloadable file that users can inspect, and do not recommend piping it directly into a shell. ]]>