T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:73
- Finding
- Unverified Remote Installer Download and Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 73–77 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The setup instructions download mutable scripts from an external server and immediately execute them in Bash or PowerShell. They do not pin a release, verify a cryptographic signature or checksum, or provide an opportunity to inspect the downloaded content before execution. HTTPS protects the connection in transit but does not establish that the remotely hosted script remains safe over time. Compromise of the hosting server, publishing account, DNS configuration, TLS termination infrastructure, or installer build pipeline could cause arbitrary attacker-controlled code to execute. Because the effective payload can change after the Skill has been audited, reviewing `SKILL.md` alone cannot establish what commands will ultimately run. Installing a CLI may be necessary for the declared connector functionality, but automatic pipe-to-shell execution is not the minimum privilege or safest installation mechanism required for that purpose. ### Attack Path 1. The `oo` CLI is unavailable, causing the Agent or user to follow the first-time setup instructions. 2. An attacker compromises or gains control over the remote installer endpoint or its delivery pipeline. 3. The attacker replaces the installer response with a malicious shell or PowerShell payload. 4. The documented command downloads the current response and passes it directly to the local interpreter. 5. The payload executes with all privileges of the user running the command, without integrity validation or prior inspection. 6. The payload can then access data and credentials available to that acco ...[truncated 741 chars]
- Remediation
- ## Remediation Suggestions 1. Remove both pipe-to-shell installation commands from the Skill instructions. 2. Direct users to a versioned release hosted on a verified official distribution channel. 3. Pin an explicit CLI version rather than retrieving a mutable installer. 4. Download the package to disk without executing it automatically. 5. Publish and verify a cryptographic signature using a trusted, independently distributed public key. At minimum, verify a version-specific SHA-256 checksum obtained through a separate trusted channel. 6. Allow the user or administrator to inspect the installer before execution. 7. Require explicit user approval before installing software or changing the local environment. 8. Prefer a signed operating-system package or trusted package manager with provenance and integrity controls. 9. Run installation with the least-privileged account possible and avoid administrator privileges unless a documented installation step strictly requires them. 10. Document the network destinations, files, and permissions used by the CLI so administrators can evaluate the installation before approval.