T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:14
- Finding
- Remote installer is downloaded and executed without prior inspection<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, line 14 **Vulnerability Type**: Remote payload retrieval and execution through a `curl | sh` pipeline **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.inference.sh | sh && infsh login ``` ### Technical Analysis This instruction downloads a shell script from an external URL and immediately passes it to `sh`. The effective code being executed is not contained in the audited project and can change after the Skill has been reviewed. Although the accompanying installation note states that the script selects a platform-specific binary and verifies its SHA-256 checksum, the checksum validation is itself performed by the untrusted remote script. The pipeline does not independently pin or verify the installer script before execution. HTTPS protects the connection in transit but does not protect against compromise of the hosting service, DNS or certificate infrastructure, deployment pipeline, or publisher account. The thumbnail-generation task does not inherently require arbitrary remote shell execution. Installing a command-line client may be a legitimate prerequisite, but executing a mutable installation script directly from the network exceeds the minimum privilege and trust needed for that setup. ### Attack Path 1. An attacker compromises `cli.inference.sh`, its deployment pipeline, hosting account, or another trusted distribution component. 2. The attacker replaces or modifies the returned installer script. 3. A user or agent follows the Quick Start instruction. 4. `curl` retrieves the attacker-controlled response and streams it directly into `sh`. 5. The payload executes immediately with all permissions of the current user, before `infsh login` is run. 6. The payload can access user-readable data, alter files, steal environment credentials, download additional components, or establish persistence where current-user permissions allow it. ### Impact Assessment Successful ...[truncated 747 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the `curl | sh` pipeline from the recommended installation path. 2. Direct users to download a version-pinned release artifact separately. 3. Publish checksums through an independently trusted, versioned release channel and require verification before execution. 4. Prefer signed release artifacts and verify the signature against a documented publisher key. 5. Show a transparent manual installation sequence, for example: - Download a specific version to a local file. - Verify its cryptographic digest or signature. - Inspect or extract the artifact. - Install it into a user-owned directory without administrative privileges. 6. If an installer script remains available, pin its immutable version and digest rather than retrieving a mutable URL. 7. Keep installation separate from authentication so users can validate the installed binary before entering credentials. 8. Explicitly warn users not to execute the installer as root or with `sudo`. ]]>