T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:126
- Finding
- Unverified Remote Installation Scripts Are Executed Directly by the Shell## Vulnerability Details **File Location**: `SKILL.md`, lines 126–134 **Vulnerability Type**: `T03: Remote Payload Retrieval and Execution` **Risk Level**: High The first-time setup instructions recommend downloading mutable scripts from an external server and immediately executing them: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis Both installation methods connect a network retrieval command directly to a command interpreter. Neither method pins a specific release nor verifies a cryptographic signature or checksum before execution. Consequently, the code ultimately executed can change after the Skill has been reviewed. Installing the `oo` CLI is relevant to the Skill's declared connector functionality, and the referenced domain appears consistent with the declared OOMOL service. However, direct download-to-shell execution is not the minimum safe installation mechanism. It grants the remote script the full privileges of the user running the agent and provides no meaningful opportunity to inspect the payload before execution. The same weakness exists on both supported platform families: - On macOS and Linux, `curl` sends the downloaded response directly to `bash`. - On Windows, `Invoke-RestMethod` downloads the response and `Invoke-Expression` evaluates it as PowerShell code. No evidence in the audited file establishes that the remote scripts are currently malicious. The vulnerability is that compromise of the delivery path or vendor infrastructure would turn these documented setup commands into an arbitrary code-execution channel. ### Attack Path 1. The `oo` command is unavailable, causing the agent or user to consult the first-time setup instructions. 2. An attacker compromises the installation server, its deployment pipeline, or another trusted component in th ...[truncated 1529 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `curl | bash` and `irm | iex` installation patterns. 2. Direct users to a documented package manager or a versioned release artifact from the official distribution channel. 3. Pin the CLI to a specific reviewed version rather than retrieving an unversioned installation script. 4. Publish a cryptographic checksum or signature through an independently protected release channel. 5. Require users to download the artifact first, verify its checksum or signature, and only then execute or install it. 6. Present the exact artifact URL, expected version, expected digest, and verification commands in the setup instructions. 7. Require explicit user approval before installing software; the agent should not perform installation automatically after a command failure. 8. Recommend installation from a non-elevated account and clearly warn users not to run the installer with administrative or root privileges unless strictly required. 9. If an installation script remains necessary, pin its immutable revision and verify the downloaded content before invoking the interpreter. For example, download to a file, validate a published SHA-256 digest or signature, allow inspection, and execute it as a separate step. 10. Protect release infrastructure with signed releases, restricted deployment permissions, multifactor authentication, and auditable build provenance.