T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:14
- Finding
- Unverified Remote Installation Script Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:14` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis The command pipes a mutable HTTP response directly into `sh`. Although the document states that the installer verifies the subsequently downloaded binary, the bootstrap script itself is executed before its content, checksum, signature, or version is independently verified. HTTPS protects the connection in transit but does not eliminate risks from a compromised hosting server, account or DNS takeover, certificate misuse, or malicious changes to the remotely hosted script. Consequently, the effective code executed by this reviewed Skill can change at any time without changing `SKILL.md`. This installation behavior also exceeds the minimum privileges required to provide the Skill's declared video-ad specifications. The installer does not require elevated privileges according to the document, but it still receives all permissions available to the Agent's current operating-system user. ### Attack Path 1. A user or Agent loads the Skill and follows its Quick Start instructions. 2. `curl` retrieves the current content served by `https://cli.inference.sh`. 3. The response is passed directly to `sh` without inspection or pre-execution integrity verification. 4. If the endpoint or its delivery infrastructure is compromised, attacker-controlled shell commands execute as the current Agent user. 5. Those commands can access files and credentials available to that user, modify the environment, install additional software, or launch other processes. 6. The command then starts `infsh login`, potentially exposing the subsequent authentication workflow to a compromised installation. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running the co ...[truncated 293 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` installation method from the primary workflow. 2. Pin the CLI to a specific, reviewed version and immutable release URL. 3. Download the artifact without executing it: ```bash curl --fail --location --output infsh "<version-pinned-release-url>" ``` 4. Publish and pin the expected SHA-256 digest in the reviewed Skill rather than obtaining both the artifact and expected digest from the same mutable source. 5. Prefer signed releases and verify the signature with a trusted public key distributed through an independent channel. 6. Install the verified artifact using only user-level permissions. 7. Keep `infsh login` as a separate command and require explicit user approval before beginning authentication. 8. Provide manual inspection and installation steps as the default; if an installer remains available, treat it only as an optional alternative accompanied by a clear warning. ]]>