T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:65- Finding
Unverified Remote Installation Scripts Executed Directly by Shells
- Content
View full analysis
): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The installation instructions retrieve mutable scripts from `cli.oomol.com` and immediately execute them through Bash or PowerShell. Neither installation path pins the downloaded artifact to a reviewed version nor verifies a cryptographic checksum or digital signature before execution. The effective code executed on the host is therefore not contained in the audited Skill. It can change independently after review. Compromise of the distribution server, DNS or TLS trust infrastructure, deployment pipeline, or OOMOL account controlling the scripts could cause arbitrary attacker-controlled code to be returned. Although installation is presented as a fallback for a missing CLI, executing a remote response directly in a shell is not the minimum privilege necessary to install a command-line utility safely. ### Attack Path 1. The agent attempts to run an `oo` command and receives an `oo: command not found` error. 2. The Skill directs the user or agent to execute the platform-specific installation command. 3. The command downloads the current script from `cli.oomol.com`. 4. The response is passed directly to Bash or PowerShell without inspection or integrity verification. 5. A compromised or malicious response executes with the privileges of the invoking user. 6. The payload can access user-readable data, alter files, install additional software, or establish persistence where the invoking account has permission. ### Impact Assessment Successful expl ...[truncated 600 chars]- Remediation
View remediation