T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:704
- Finding
- Unverified Remote Installer Download and Immediate Shell Execution## Vulnerability Details **File Location**: `SKILL.md:704-711` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Complete Code Snippet**: ```markdown - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The installation instructions retrieve mutable scripts from an external URL and pass the responses directly to Bash or PowerShell. Neither command pins a specific release nor verifies a cryptographic signature or checksum before execution. The user and agent also receive no opportunity to inspect the downloaded content before it runs. Consequently, the code that executes can differ from the content available when the Skill was reviewed. Compromise of the vendor hosting account, web server, CDN, DNS resolution, TLS termination infrastructure, or installer publication process could replace the expected installer with arbitrary commands. Installation is relevant to the Skill's operation when the required CLI is missing, and the instructions appropriately defer setup until a matching failure occurs. However, immediate pipe-to-shell execution exceeds the minimum safe privilege necessary to install the dependency. A separately downloaded, version-pinned, integrity-verified package would satisfy the same functional requirement with materially less risk. The equivalent PowerShell instruction has the same security property: `Invoke-RestMethod` retrieves arbitrary text and `Invoke-Expression` executes it directly. ### Attack Path 1. The agent attempts to use the `oo` CLI and receives an `oo: command not found` error. 2. Following the Skill's first-time setup instructions, it runs the Bash or PowerShell insta ...[truncated 1498 chars]
- Remediation
- ## Remediation Suggestions 1. Remove both direct execution patterns: - `curl ... | bash` - `irm ... | iex` 2. Pin installation to a specific, reviewed CLI release rather than a mutable generic installer URL. 3. Download the artifact to a local file without executing it. 4. Verify its SHA-256 or stronger digest against a value published through an independently protected channel. 5. Prefer a cryptographically signed package and verify the publisher signature before installation. 6. Display the package version, source URL, destination, expected changes, and requested privileges to the user. 7. Require explicit user approval before running any installer. 8. Avoid elevated installation where a per-user location is sufficient. 9. Prefer signed native package-manager distributions or official, immutable release artifacts. 10. Fail closed if signature or checksum verification is unavailable or unsuccessful. 11. Document that App Store Connect payloads are processed by OOMOL and advise users not to place raw secrets in unnecessary action fields.