T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:14
- Finding
- Mutable Remote Installer Executed Directly by the Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The Quick Start instructions download a mutable script from an external URL and immediately pipe it into `sh`. The user has no opportunity to inspect the downloaded content, and the command does not pin a version, expected cryptographic digest, or publisher signature before execution. The later statement that the installer verifies the downloaded CLI binary does not secure the installer script itself. A compromised or subsequently modified installer can execute arbitrary commands before performing—or instead of performing—the claimed binary verification. Installing a CLI is relevant to the Skill's declared functionality, but executing an unverified remote response directly in a shell exceeds the minimum privilege and trust required. A manual installation procedure using an immutable artifact and independently verified signature or checksum would reduce this exposure. ### Attack Path 1. A user or agent follows the documented Quick Start command. 2. `curl` retrieves the current response from `https://cli.inference.sh`. 3. The response is passed directly to `sh` without inspection or pre-execution verification. 4. An attacker who compromises the hosting service, release infrastructure, DNS/TLS path, or installer publication process substitutes malicious shell commands. 5. Those commands execute with the privileges of the user running the Skill instructions. 6. The command subsequently invokes `infsh login`; if the attacker installed or replaced that executable, it can intercept authentication information or display a spoofed login flow. ### Impact Assessment Successful exploitation provides arbitrary command execution under the invoking user's account. This can permit access to files and credenti ...[truncated 449 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` installation pattern from the Quick Start instructions. 2. Pin the CLI to a specific immutable version and trusted artifact URL. 3. Download the artifact to a local file without executing it. 4. Verify it using a publisher-authenticated signature. If signatures are unavailable, publish and pin the expected SHA-256 digest in the reviewed Skill rather than retrieving both the artifact and checksum from the same mutable source. 5. Inspect or verify the installer separately if an installer remains necessary. 6. Install the verified artifact using the least-privileged destination available; do not require administrator privileges unless strictly necessary. 7. Place `infsh login` in a separate command so authentication occurs only after the user has verified the installed executable. 8. Document the files, network endpoints, and credentials the CLI accesses during installation and login. A safer workflow would be: ```bash curl -fLo infsh "<version-pinned-artifact-url>" echo "<reviewed-sha256> infsh" | sha256sum -c - chmod 0755 infsh # Move to a user-controlled executable directory, then authenticate separately. ``` ]]>