T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:60
- Finding
- Unverified Remote Installation Scripts Executed Directly by Shells<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 60–64 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable scripts from external URLs and immediately execute their contents through Bash or PowerShell. Neither command pins an immutable release nor verifies a cryptographic signature or checksum before execution. Although the URLs use HTTPS and appear to belong to the documented CLI vendor, HTTPS alone does not establish that the downloaded script is safe or unchanged. Compromise of the hosting infrastructure, publishing process, vendor account, or remote script could cause these instructions to execute attacker-controlled code after the skill has already been reviewed. This behavior exceeds the minimum privileges required for the skill's declared connector functionality. The document initially assumes that the `oo` CLI is already installed, while remote script execution is only introduced as a fallback when the command is missing. Calling Apiframe does not inherently require executing an unverified installation script. ### Attack Path 1. A user or agent attempts to use the skill on a system where the `oo` command is unavailable. 2. The documented fallback directs the user or agent to retrieve `install.sh` or `install.ps1`. 3. An attacker compromises or modifies the remotely hosted installation script or its publication infrastructure. 4. `curl | bash` or `irm | iex` passes the response directly to the relevant command interpreter without prior inspection or integrity verification. 5. The attacker-controlled script executes with the privileges of the invoking process. 6. The script can access data available to that account, alter files, insta ...[truncated 889 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the direct `curl | bash` and `irm | iex` installation patterns. 2. Prefer a trusted operating-system package manager or a signed, versioned release from the official repository. 3. Pin installation instructions to a specific immutable CLI version rather than a mutable generic installer URL. 4. Download the installer or release artifact to disk without executing it automatically. 5. Publish an expected SHA-256 or stronger checksum over a separately secured channel and verify it before execution. 6. Where supported, verify a cryptographic release signature and document how users can validate the signing identity. 7. Require explicit user approval before installing software or running any downloaded script. 8. If a script remains necessary, instruct users to inspect it before execution and run it with the least-privileged account needed. 9. Keep installation outside the normal skill execution path. On a missing dependency, report the condition and provide a verified installation link rather than allowing an agent to install software autonomously. 10. Apply equivalent protections to both the macOS/Linux and Windows installation paths. ]]>