T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:59
- Finding
- Unverified Remote Installer Downloaded and Executed Directly## Vulnerability Details **File Location**: `SKILL.md`, lines 59–63 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable scripts from an external server and immediately execute their contents through Bash or PowerShell. The downloaded payload is not displayed for review, pinned to a specific version, or validated using a cryptographic checksum or signature. The installer source is not included in the audited project, so its effective behavior cannot be determined from the reviewed package. Although the URLs use HTTPS and an apparently related OOMOL domain, transport encryption does not mitigate compromise of the hosting infrastructure, DNS or account takeover, or subsequent replacement of the remote scripts. Direct remote execution is not necessary for the skill's declared DaData query functionality and exceeds the minimum privileges required to document or invoke connector operations. ### Attack Path 1. The `oo` command is unavailable and an agent or user follows the first-time setup instructions. 2. `curl` or `Invoke-RestMethod` downloads the current installer from the external OOMOL server. 3. The response is passed directly to Bash or `Invoke-Expression` without integrity verification or inspection. 4. If the hosting server, delivery path, or remote script has been compromised, attacker-controlled commands execute with the permissions of the invoking user. 5. Those commands can access resources available to that user and may install additional components or establish persistence. ### Impact Assessment Successful exploitation permits arbitrary command execution with the invoking user's privileges. The resulting sco ...[truncated 531 chars]
- Remediation
- ## Remediation Suggestions - Remove the direct `curl | bash` and `irm | iex` installation patterns. - Distribute the CLI through a trusted package manager or a versioned release channel. - Pin installation instructions to a specific CLI version and immutable artifact. - Download the artifact without executing it, then verify a published cryptographic checksum or signature before installation. - Provide users with an opportunity to inspect the downloaded script or package before execution. - Require explicit user approval before installing software or running any installer. - Document the expected files, permissions, and system changes made by the installer. - Avoid requesting administrator or root privileges unless a specific installation step demonstrably requires them.