T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:61
- Finding
- Unverified Remote Installation Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 61–65 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High The first-time setup instructions execute remotely hosted installation scripts directly in Bash and PowerShell: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis Both commands retrieve mutable content from an external server and pass it immediately to a command interpreter. The instructions provide no immutable version pinning, cryptographic signature verification, checksum validation, or opportunity to inspect the downloaded scripts before execution. Installation of the `oo` CLI supports the Skill's declared Checkly functionality. However, directly piping remote content into a shell exceeds the minimum privileges and trust required to install that dependency safely. The effective code executed can change at any time after this Skill has been reviewed. Successful exploitation would require control over, or compromise of, a relevant delivery point such as the remote hosting infrastructure, published installer, domain, DNS resolution, or trusted TLS path. A malicious or compromised installer could execute arbitrary commands with the privileges of the user running the setup command. ### Attack Path 1. The `oo` CLI is unavailable, and an agent or user follows the documented first-time setup procedure. 2. An attacker compromises or otherwise gains control over the installer delivered from `cli.oomol.com`, or a relevant part of its delivery chain. 3. The `curl` or `irm` command downloads attacker-controlled script content. 4. Bash or PowerShell executes the content immediately, without integrity validation or review. 5. The payload performs arbitrary actions using the invoking process's permissions, potentially including cred ...[truncated 872 chars]
- Remediation
- ## Remediation Suggestions 1. Replace direct remote-to-shell execution with installation through a trusted package manager or a pinned, immutable release artifact. 2. Download the installer to a local file without executing it: ```bash curl -fLo install.sh https://cli.oomol.com/releases/<pinned-version>/install.sh ``` 3. Publish and verify a cryptographic signature from a separately distributed, trusted signing key. If signatures are unavailable, verify a pinned SHA-256 checksum obtained through an independent trusted channel. 4. Execute the installer only after successful verification and, where practical, manual inspection: ```bash sha256sum -c install.sh.sha256 bash install.sh ``` 5. Apply equivalent download, signature or checksum verification, and separate execution steps for the PowerShell installer. 6. Document the exact CLI version being installed and avoid mutable URLs such as a generic `install.sh` or `install.ps1`. 7. Run installation with the least-privileged account possible. Do not request administrator or root access unless a documented installation step strictly requires it. 8. Consider making installation a user-controlled prerequisite rather than allowing an automated agent to execute installer instructions.