T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:55
- Finding
- Unverified Remote Installer Scripts Are Executed Directly<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 55–59 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions retrieve mutable scripts from `cli.oomol.com` and immediately pass their contents to Bash or PowerShell. Neither command verifies a cryptographic signature, pinned checksum, immutable version, or expected script contents before execution. TLS protects data in transit under normal conditions, but it does not protect against compromise of the hosting server, DNS or certificate infrastructure, deployment pipeline, or publisher account. Because the downloaded content is not pinned, its effective behavior can change after the Skill has been reviewed. Installing the CLI may be necessary for the declared Fairing integration, but executing an unverified installer is not the minimum privilege or minimum-risk method required to achieve that function. It also extends beyond the Skill's declared `Bash(oo *)` runtime boundary by instructing the user or agent to execute arbitrary Bash or PowerShell content. No evidence in the audited file establishes that the current remote scripts are malicious. The vulnerability is the unrestricted, mutable remote-code execution channel. ### Attack Path 1. The `oo` command is unavailable and setup falls back to the documented installation instructions. 2. An attacker compromises the installer host, publishing pipeline, domain resolution, certificate infrastructure, or another component capable of controlling the returned script. 3. The user or agent executes one of the documented commands. 4. `curl` or `Invoke-RestMethod` downloads the attacker-controlled response. 5. Bash or `Invoke-Expression` executes the response immed ...[truncated 961 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove both direct download-and-execute patterns. 2. Direct users to a trusted package manager or a version-pinned release from the official project repository. 3. If a standalone installer is required: - Download it to a local file without executing it. - Pin an explicit installer or CLI version. - Publish a SHA-256 or stronger checksum through an independently protected channel. - Prefer cryptographic release signatures and verify the publisher identity. - Abort installation if verification fails. - Allow the user to inspect the downloaded file before execution. 4. Require explicit user approval before installing software or running commands outside the declared `oo` command boundary. 5. Run installation with ordinary user privileges and avoid `sudo`, administrator shells, or system-wide installation unless strictly necessary. 6. Document the files, directories, and network endpoints the installer is expected to access. 7. Prefer instructions similar to the following pattern: ```bash curl -fL -o oo-install.sh "https://trusted.example/releases/vX.Y.Z/install.sh" echo "<PINNED_SHA256> oo-install.sh" | sha256sum -c - bash oo-install.sh ``` The checksum must be obtained from a trusted, independently protected release channel rather than from the same mutable endpoint as the installer. ]]>