T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:14
- Finding
- Unverified Remote Installer Executed Directly by Shell## Vulnerability Details **File Location**: `SKILL.md`, line 14 **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: High **Complete Code Snippet**: ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The installation instruction retrieves mutable shell-script content from `https://cli.inference.sh` and pipes it directly into `sh`. The downloaded script is therefore executed with the privileges of the invoking user before the user can inspect it. The project does not pin an installer version, expected cryptographic digest, or trusted signing key. Although the documentation states that the installer verifies the checksum of the downloaded CLI binary, that claim does not independently authenticate the bootstrap script itself. A compromised origin server, distribution infrastructure, DNS or network path, or installer deployment could change the effective code after this Skill has been reviewed. Installing the external CLI supports the declared image-generation functionality, but direct pipe-to-shell execution is not the minimum-risk mechanism required to provide that functionality. Downloading a versioned artifact, verifying it independently, and obtaining explicit approval before installation would achieve the same objective without immediately executing mutable remote instructions. ### Attack Path 1. An attacker compromises or gains control over the installer endpoint, its hosting infrastructure, or a relevant software-distribution account. 2. The attacker replaces the installer response with malicious shell commands. 3. A user or agent follows the documented Quick Start command. 4. `curl` retrieves the attacker-controlled response and sends it directly to `sh`. 5. The shell executes the payload with the invoking user's permissions. 6. The payload can access resources available to that account and may tamper with the subsequently executed `infsh log ...[truncated 802 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the direct `curl | sh` installation pattern. 2. Publish versioned CLI artifacts through a trusted package registry or release channel. 3. Pin the required CLI version rather than installing an automatically changing latest release. 4. Download the installer or binary to a local file without executing it: ```bash curl --proto '=https' --tlsv1.2 -fL -o infsh.example \ https://dist.inference.sh/path/to/versioned/artifact ``` 5. Verify the artifact using an expected SHA-256 digest pinned in the reviewed Skill, or preferably a cryptographic signature validated with a trusted public key. Do not retrieve both the artifact and its sole trust value from the same mutable channel without an independent trust mechanism. 6. Require explicit user review and approval before executing or installing the downloaded artifact. 7. Install only to a user-controlled directory with no elevated privileges and document the files and permissions created. 8. Separate installation from `infsh login` so authentication occurs only after installation integrity has been verified. 9. Document a manual installation procedure and a supported package-manager alternative. 10. Consider making CLI installation an explicit prerequisite rather than allowing the Skill to initiate software installation during normal use.