T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:16
- Finding
- Unpinned Remote Installer Is Executed Directly by a Shell## Vulnerability Details **File Location**: `SKILL.md:16` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The quick-start command downloads a mutable script from `https://cli.inference.sh` and passes it directly to `sh`. The remote content is therefore executed before the user can inspect it, and no installer version, immutable digest, or locally verified signature is specified. The document states that the installer detects the operating system and architecture, downloads a binary, and verifies its SHA-256 checksum. That downstream check does not secure the bootstrap script itself: the remotely delivered script can execute arbitrary commands before, instead of, or in addition to the documented verification process. HTTPS protects the connection under normal conditions but does not make the delivered payload immutable. A compromise of the hosting domain, web application, CDN, deployment credentials, or signing infrastructure could change the effective code after this skill has been reviewed. Direct shell execution is not necessary for the declared background-removal functionality and introduces a broader code-execution channel than the task requires. ### Attack Path 1. An attacker compromises, or otherwise gains the ability to alter, content served by `cli.inference.sh` or its delivery infrastructure. 2. The attacker replaces the expected installer with a script containing arbitrary shell commands while optionally retaining normal installation behavior. 3. A user or agent follows the documented quick-start command. 4. `curl` retrieves the modified content and streams it directly to `sh`. 5. The malicious commands execute immediately with the permissions of the user running the skill. 6. The attacker may then install a modified `infsh` binary, read user-accessible fi ...[truncated 747 chars]
- Remediation
- ## Remediation Suggestions - Remove the `curl | sh` installation path from the quick-start instructions. - Publish versioned CLI artifacts at immutable release URLs and require users to download the artifact separately. - Publish a fixed SHA-256 digest or, preferably, a cryptographic signature through an independently authenticated release channel. - Require checksum or signature verification before making the binary executable or running any installer. - Pin the documented CLI version rather than retrieving the latest mutable installer. - Document the exact files, directories, environment settings, and network endpoints used by installation. - Ensure installation is performed without `sudo` or equivalent elevation and fails if elevation is unexpectedly requested. - Offer package-manager installation only through a reviewed, signed, and versioned repository. A safer documented sequence should separate download, verification, and execution, for example: ```bash curl -fL -o infsh.tar.gz https://trusted.example/releases/infsh-VERSION-PLATFORM.tar.gz echo "EXPECTED_SHA256 infsh.tar.gz" | sha256sum -c - # Extract and install only after successful verification. ```