T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:14
- Finding
- Remote Installer Is Downloaded and Executed Without Prior Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14` **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The Quick Start instruction streams the response from `https://cli.inference.sh` directly into a shell. The effective executable content is therefore controlled by a mutable external resource and cannot be reviewed from the Skill package. Although the installation note claims that the remote script verifies the SHA-256 checksum of the downloaded binary, this does not authenticate the installer itself. The unverified script begins executing before any stated binary checksum validation occurs. A malicious installer could skip verification, substitute a checksum source, execute unrelated commands, or install a modified `infsh` binary. This behavior exceeds the minimum privileges required for the Skill's declared purpose. Providing guidance for explainer-video production does not require granting a remote server arbitrary shell execution under the user's account. ### Attack Path 1. A user or Agent follows the Quick Start instructions. 2. The shell requests the current content of `https://cli.inference.sh`. 3. An attacker who compromises the hosting infrastructure, domain, delivery pipeline, or another relevant trust dependency modifies the returned installer. 4. `curl` streams that modified response directly into `sh`. 5. The attacker's commands execute with all permissions available to the invoking user. 6. The malicious installer may replace the expected CLI or install an additional payload. 7. The subsequent `infsh login` command may run the substituted binary and expose login credentials or tokens to it. ### Impact Assessment Successful exploitation provides arbitrary code execution with the invoking user's privileges. Depending on those privileges and the local environment, an att ...[truncated 599 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` installation pattern. 2. Pin the CLI to a specific immutable version rather than retrieving an unspecified current release. 3. Download the binary as a separate, non-executing step. 4. Publish the expected SHA-256 digest in a version-controlled, reviewed file or instruction within the Skill. 5. Verify the downloaded artifact before granting execute permission or running it. 6. Prefer cryptographically signed release artifacts and verify the signature against a documented trusted public key. 7. Display the exact destination and required permissions before installation. 8. Do not invoke `infsh login` automatically as part of installation; make authentication an explicit, separate user action. 9. Where possible, use a trusted package manager with version pinning and integrity verification. A safer conceptual flow is: ```bash curl -fSLo infsh "<versioned-release-URL>" printf '%s %s\n' "<reviewed-sha256>" "infsh" | sha256sum --check - chmod 0755 infsh ./infsh login ``` The release URL and digest must be pinned to the same reviewed version. Users should also be encouraged to inspect provenance and signatures before execution. ]]>