T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:56
- Finding
- Unverified Remote Installer Download and Immediate Shell Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 56–60 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete Code Snippet**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The setup instructions download mutable scripts from an external server and immediately execute them with the invoking user's shell. The Unix command pipes the HTTP response directly into Bash, while the Windows command passes the downloaded response to `Invoke-Expression`. Neither command pins an installer version, validates a cryptographic digest or signature, nor provides an inspection boundary between download and execution. HTTPS protects data in transit but does not protect against compromise of the distribution server, publishing account, DNS infrastructure, or signing and release process. The effective code can also change after the Skill has been audited. Installing the declared CLI may be necessary for the Skill's operation, and the instructions limit installation to a first-time fallback after a command-not-found error. However, immediate execution of an unverified remote response exceeds the minimum privilege and trust required to explain or install the dependency safely. ### Attack Path 1. An attacker compromises the installer host, its deployment pipeline, the controlling account, or another component capable of changing the remote installer response. 2. The attacker replaces `install.sh` or `install.ps1` with a malicious payload. 3. A user or Agent encounters the documented `oo: command not found` condition and follows the first-time setup instructions. 4. `curl` or `Invoke-RestMethod` retrieves the attacker-controlled response. 5. Bash or `Invoke-Expression` executes the response immediately, without integrity verification or pr ...[truncated 992 chars]
- Remediation
- ## Remediation Suggestions - Do not pipe a network response directly into a shell or pass it to `Invoke-Expression`. - Prefer a trusted platform package manager or a version-pinned release artifact from the vendor's official repository. - Download the installer or binary to a local file without executing it. - Pin an explicit CLI version rather than relying on a mutable latest installer. - Verify the downloaded artifact using a cryptographic signature or a checksum obtained through a separately authenticated channel. - Provide the expected signer identity, checksum, version, and verification commands in the documentation. - Execute the verified artifact as a separate, explicit step and request only the minimum permissions required. - Avoid elevated execution unless it is strictly necessary, clearly disclosed, and separately approved. - Retain the existing behavior of attempting the action before offering installation, so dependency installation occurs only when genuinely required. A safer Unix workflow would follow this pattern: ```bash curl -fL -o oo-installer.sh "https://trusted.example/oo/releases/vX.Y.Z/install.sh" echo "<EXPECTED_SHA256> oo-installer.sh" | sha256sum --check - less oo-installer.sh bash oo-installer.sh ``` The expected digest must be supplied through an authenticated, version-specific release channel. Windows instructions should similarly use a pinned download, verify an Authenticode signature or published digest, and invoke the local verified file without `iex`.