T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:61
- Finding
- Unverified Remote Installation Scripts Are Executed Directly<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 61–65 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions download scripts from an external server and immediately pass their contents to a command interpreter. The effective code executed by these commands is not contained in the reviewed Skill and can change after the Skill has been audited. Neither installation path pins a release nor verifies a cryptographic signature or checksum. HTTPS provides transport protection but does not establish that the returned script matches an independently reviewed artifact. Compromise of the hosting service, publishing credentials, DNS infrastructure, or distribution pipeline could therefore result in arbitrary code being returned and executed. The behavior is presented as a fallback when the `oo` command is unavailable. Installing the declared CLI may be necessary to use the Skill, but immediate execution of mutable network content exceeds the minimum privileges and trust required for installation. The same risk exists in both the Bash and PowerShell commands. ### Attack Path 1. A CustomGPT.ai action is requested while the `oo` CLI is unavailable. 2. The attempted action fails with an `oo: command not found` error. 3. The installation fallback is followed. 4. `curl` or `Invoke-RestMethod` retrieves the current script from `cli.oomol.com`. 5. The response is passed directly to Bash or `Invoke-Expression` without being saved, inspected, pinned, or authenticated against a trusted checksum or signature. 6. If the remote origin or its delivery pipeline has been compromised, attacker-controlled commands execute with the permissions of the user running the instal ...[truncated 1034 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove both pipe-to-shell installation commands. 2. Pin installation instructions to a specific, reviewed CLI version rather than a mutable installation endpoint. 3. Download the installer or release artifact to a local file without executing it immediately. 4. Verify the artifact using a cryptographic signature from a separately authenticated trust root. If signatures are unavailable, publish and verify a version-specific SHA-256 checksum obtained through an independent trusted channel. 5. Abort installation if verification fails; do not provide an option that silently bypasses integrity checks. 6. Allow the user or administrator to inspect the downloaded script before execution. 7. Prefer signed platform-native packages or official package repositories that provide integrity validation and version pinning. 8. Run installation with ordinary user privileges unless a specific operation demonstrably requires elevation. If elevation is necessary, isolate and document the exact privileged operation rather than running the complete remote installer with elevated rights. 9. For PowerShell, avoid `Invoke-Expression`; save the script, validate its signature and hash, and invoke the verified local file with an appropriate execution policy. 10. Document the network destinations, files created, permissions required, and expected post-installation changes so users can evaluate the installation's scope. ]]>