T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:53- Finding
Unverified Remote Installer Downloaded and Executed Directly
- Content
View full analysis
): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The installation instructions pipe remotely downloaded content directly into a command interpreter. On macOS and Linux, `curl` sends the response to `bash`; on Windows, `Invoke-RestMethod` downloads the response and `Invoke-Expression` executes it. Neither command pins a release version, validates a cryptographic signature, nor checks an expected digest. Consequently, the code executed by users can differ from the content available when this Skill was reviewed. HTTPS protects the transport connection but does not establish that the installer remains unchanged or safe after a compromise of the server, publishing credentials, DNS infrastructure, or delivery pipeline. Although installing the required CLI supports the declared functionality, direct remote-to-shell execution is not necessary and exceeds the minimum safe installation mechanism. ### Attack Path 1. An attacker compromises the installer host, deployment pipeline, domain, or credentials used to publish `install.sh` or `install.ps1`. 2. The attacker replaces the installer response with a malicious script. 3. The `oo` command is unavailable, causing the user or Agent to follow the documented first-time setup procedure. 4. The shell pipeline downloads the current attacker-controlled response and executes it immediately without integrity verification or review. 5. The payload executes with the privileges of the invoking account and can access resources available to that account. ...[truncated 636 chars]- Remediation
View remediation