T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:63- Finding
Unverified Remote Installer Scripts Executed Directly by Shells
- Content
View full analysis
): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The installation instructions download mutable scripts from an external server and immediately execute them through Bash or PowerShell. No fixed release version, cryptographic checksum, digital signature, or manual inspection step is required before execution. Although `cli.oomol.com` is consistent with the declared OOMOL service, these instructions make the code ultimately executed depend on whatever the remote server returns at installation time. The executed payload can therefore change after the Skill has been reviewed. Compromise of the hosting infrastructure, deployment pipeline, DNS resolution, or applicable TLS trust chain could convert the documented installation process into arbitrary code execution. Installing a required CLI may be necessary for the Skill's functionality. However, direct network-to-shell execution exceeds the minimum privilege and trust necessary because safer package retrieval, integrity verification, and explicit user approval mechanisms are available. ### Attack Path 1. The `oo` command is unavailable, causing the user or agent to consult the first-time setup instructions. 2. An attacker compromises or gains influence over the remote installer response, its deployment pipeline, domain resolution, or another relevant delivery component. 3. The user runs the documented `curl | bash` or `irm | iex` command. 4. The shell executes the response without verifying a pinned artifact, checksum, or signature. 5. The payloa ...[truncated 894 chars]- Remediation
View remediation