T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:59
- Finding
- Unverified Remote Installation Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 59–63 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable code:** ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve scripts from `cli.oomol.com` and immediately execute them using `bash` or PowerShell `Invoke-Expression`. The downloaded content is not pinned to a specific version, inspected before execution, or authenticated through a cryptographic signature or published checksum. Although HTTPS provides transport protection, it does not establish that the script is immutable or safe. The effective payload can change after the Skill has been reviewed. Compromise of the hosting service, deployment pipeline, domain, or publisher account could therefore turn these documented installation commands into an arbitrary-code-execution channel. Installing the required CLI is relevant to the Skill's declared Holded connector functionality. However, executing mutable and unverified network content directly in the user's shell exceeds the minimum privilege necessary to provide installation guidance. The Windows command presents the same underlying risk as `curl | bash`. ### Attack Path 1. A user or agent attempts to invoke the Skill when the `oo` CLI is unavailable. 2. The command fails with `oo: command not found`, causing the first-time setup instructions to be used. 3. The user or agent runs the documented installation command. 4. The command retrieves the current script from `https://cli.oomol.com/install.sh` or `https://cli.oomol.com/install.ps1`. 5. `bash` or PowerShell `iex` executes the response immediately without integrity or authenticity verification. 6. If the remote endpoint or its publishing pipeline has been compromi ...[truncated 738 chars]
- Remediation
- ## Remediation Suggestions 1. Remove direct `curl | bash` and `irm | iex` installation patterns. 2. Direct users to an official package manager or a versioned release artifact from a controlled release channel. 3. Pin the installer or binary to an explicit, reviewed version rather than an unversioned mutable URL. 4. Download the artifact as a separate step and verify a publisher-provided cryptographic signature or SHA-256 checksum before execution. 5. Display the resolved source, version, and expected system changes, and require explicit user approval before running an installer. 6. Run installation with ordinary user privileges unless a specific operation demonstrably requires elevation; isolate any privileged step and document why it is necessary. 7. Publish reproducible release metadata and retain prior signed artifacts so audits can verify exactly what code was installed. 8. For PowerShell, avoid `Invoke-Expression`; save a signed script locally, validate its signature and hash, and invoke the verified file explicitly.