T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:57
- Finding
- Unverified Remote Installer Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 57–61 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical The first-time setup instructions execute remotely hosted installer scripts directly in Bash and PowerShell: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis Both installation commands retrieve mutable code from an external server and immediately pass it to a command interpreter. The referenced payload is not pinned to a version, saved for inspection, checked against an expected cryptographic digest, or verified using a trusted publisher signature. TLS protects the network connection in transit but does not establish that the script remains identical to the version reviewed with this Skill. Compromise of the hosting server, publishing account, DNS infrastructure, certificate issuance process, or upstream deployment pipeline could cause different code to be delivered and executed. This behavior is not required for the Skill's core Leonardo.Ai connector operations. Installation may be necessary when the CLI is absent, but immediate execution of unverified remote content exceeds the minimum privilege and trust necessary to provide installation guidance. ### Attack Path 1. An attacker compromises the OOMOL installer host, publishing pipeline, deployment credentials, or another component capable of changing the installer response. 2. The attacker replaces `install.sh` or `install.ps1` with a malicious payload. 3. A user encounters the documented `oo: command not found` condition and follows the first-time setup instructions. 4. `curl` or `irm` retrieves the attacker-controlled content. 5. The shell immediately executes that content without an integrity or authenticity check. 6. The payload performs arbitrary actions u ...[truncated 766 chars]
- Remediation
- ## Remediation Suggestions - Remove the direct `curl | bash` and `irm | iex` installation patterns. - Prefer a trusted platform package manager and pin the CLI to a reviewed version. - If direct downloads are necessary, publish immutable, versioned artifacts rather than mutable installer endpoints. - Download the artifact to a local file before execution so it can be inspected separately. - Publish a cryptographic checksum through an independently protected channel and verify it before execution. - Prefer a verifiable publisher signature backed by a documented trust root; fail closed when verification fails. - Execute installation with ordinary user privileges unless a specific operation demonstrably requires elevation. - Document the files, directories, network endpoints, and configuration changes performed by the installer. - Retain the existing instruction to install only after an actual command-not-found failure, but direct users to a reviewed installation guide rather than executing remote content immediately.