T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:14
- Finding
- Unverified Remote Installer Piped Directly into a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 14 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The Quick Start instructions download mutable content from an external URL and pipe it directly into `sh`. The installer is therefore executed before the user can inspect it, and neither the installer version nor its cryptographic digest is pinned by the command. The document states that the installer verifies the SHA-256 checksum of the CLI binary. However, this does not establish the integrity of the installer itself. Because the remote script controls both the installation process and the verification logic, a compromised or malicious installer could bypass verification, select a different artifact, or execute unrelated commands. This execution method is not required for the Skill's declared character-image generation functionality. A specific CLI release could instead be downloaded and verified independently before execution. Although the documentation claims that elevated permissions and background processes are not used, the shell script receives all permissions available to the invoking user and is not technically constrained to the described behavior. ### Attack Path 1. A user follows the documented Quick Start command. 2. `curl` requests the current content hosted at `https://cli.inference.sh`. 3. The remote host, distribution infrastructure, or delivery path is compromised, or the publisher changes the script after this Skill has been reviewed. 4. The returned content is streamed directly to `sh` without local inspection or independent integrity verification. 5. The malicious script executes with the permissions of the invoking user. 6. The command subsequently runs `infsh login`, allowing a substituted or modified CLI to capture credentials or authentication tokens. 7. The payl ...[truncated 1059 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` installation method from the default Quick Start instructions. 2. Direct users to a versioned release artifact from an authenticated official release page. 3. Pin a specific CLI version rather than retrieving a mutable latest release. 4. Download the artifact and its checksum or signature as separate files without executing either one. 5. Verify the artifact against a digest or digital signature distributed through an independent trusted channel. 6. Publish the expected digest directly in version-controlled documentation when practical. 7. Require users to inspect or explicitly execute the verified installer or binary as a separate step. 8. Avoid automatically chaining installation with `infsh login`; authentication should occur only after users have confirmed the installed binary's provenance. 9. Document the files, directories, network endpoints, and permissions used by the installer. 10. Prefer a trusted, signed package-manager distribution where the package is version-pinned and reproducibly built. A safer workflow should resemble: ```bash # Example structure only; replace placeholders with a reviewed release. curl -fLO https://dist.inference.sh/cli/releases/<pinned-version>/<artifact> echo "<trusted-sha256> <artifact>" | sha256sum --check install <artifact> "$HOME/.local/bin/infsh" infsh login ``` The expected digest must come from a trusted source independent of the downloaded artifact and must not be dynamically supplied by the same unverified installer. ]]>