T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:14
- Finding
- Unverified Remote Installer Executed Directly by Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The Quick Start command downloads mutable content from `https://cli.inference.sh` and pipes it directly into `sh`. The remote script executes immediately with the invoking user's privileges, without first being saved, inspected, pinned to a specific version, or authenticated using a user-verified signature or digest. The document states that the installer verifies the SHA-256 checksum of the CLI binary it downloads. This does not establish the integrity of the bootstrap script itself: the remotely hosted script determines which binary and checksum to use and can change after this Skill has been reviewed. Consequently, the effective executable payload is outside the audited repository. Installing a CLI may be necessary for the Skill's declared image-generation functionality, but direct shell execution of mutable network content is not the least-privilege or minimum-risk installation method. ### Attack Path 1. A user or agent follows the documented Quick Start command. 2. `curl` retrieves the current response from `cli.inference.sh`. 3. A compromise of the hosting infrastructure, delivery pipeline, domain, or remote installer causes malicious shell content to be returned. 4. The pipe sends that content directly to `sh`, with no opportunity for inspection or independent integrity verification. 5. The malicious content executes with the current user's privileges. 6. The payload can modify user-accessible files, install altered executables, collect accessible secrets, or establish persistence. 7. The subsequent `infsh login` operation may expose authentication material to a malicious or replaced CLI. ### Impact Assessment Successful exploitation permits arbitrary command execution under the ac ...[truncated 549 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` installation pipeline. 2. Pin installation instructions to a specific, immutable CLI release and artifact URL. 3. Download the artifact to disk before execution: - Use HTTPS. - Verify a SHA-256 digest published in a version-controlled, independently trusted location. - Prefer a cryptographic signature whose public verification key is distributed separately from the artifact host. 4. Present the installer or package for inspection and require explicit user confirmation before executing it. 5. Prefer a trusted package manager with version pinning and signature verification where available. 6. Document the files, directories, network endpoints, and credentials the CLI accesses. 7. Keep installation separate from `infsh login` so a user can verify the installed binary before providing authentication material. 8. Run the CLI as an unprivileged user and explicitly prohibit use with `sudo` or a root account unless a documented operation strictly requires it. ]]>