T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:14
- Finding
- Remote Installer Is Downloaded and Executed Without Prior Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 14 **Vulnerability Type**: Remote payload retrieval and immediate shell execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The installation command streams the current response from `https://cli.inference.sh` directly into `sh`. Because the downloaded script is not saved, inspected, version-pinned, or independently authenticated before execution, its effective behavior can change after this Skill has been reviewed. The document states that the installer downloads a matching binary and verifies its SHA-256 checksum. However, that does not establish the integrity of the installer itself: the unverified remote script is already executing when it performs any claimed binary verification. A compromised distribution server, changed installer, or upstream infrastructure compromise could therefore cause arbitrary commands to run. Installing the CLI supports the declared image-generation workflow, but piping mutable remote content directly to a shell exceeds the minimum execution risk necessary to provide that functionality. A version-pinned binary downloaded and verified before execution would be safer. ### Attack Path 1. A user follows the Quick Start instructions. 2. `curl` retrieves the current script served by `cli.inference.sh`. 3. The response body is passed directly to the local shell without inspection or pre-execution integrity validation. 4. If the endpoint or its delivery infrastructure serves altered content, that content executes with the invoking user's privileges. 5. The payload could read or modify user-accessible files, access environment variables and credentials available to the process, install additional software, or retrieve further payloads. ### Impact Assessment Successful exploitation provides arbitrary command execution under the account running the command. The reachable sco ...[truncated 516 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` pipeline. 2. Publish immutable, versioned CLI artifacts rather than relying on a mutable installer endpoint. 3. Download the selected artifact without executing it: ```bash curl -fSLo infsh https://dist.example.invalid/infsh/VERSION/infsh-PLATFORM ``` 4. Publish a checksum or cryptographic signature through a separately secured and authenticated channel. 5. Require users to verify the artifact before installation: ```bash echo "EXPECTED_SHA256 infsh" | sha256sum --check - ``` 6. Prefer signature verification with a documented public key over an unauthenticated checksum hosted beside the artifact. 7. Document the destination path and required permissions. Do not request administrator privileges unless they are strictly necessary. 8. Pin the installer or binary version and provide reproducible release provenance, such as signed release metadata or build attestations. 9. If an installer remains available, make manual download, inspection, and verification the default installation method rather than an optional note. ]]>