T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:64
- Finding
- Unverified Remote Installation Scripts Executed Directly by Shell Interpreters## Vulnerability Details **File Location**: `SKILL.md`, lines 64–68 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions download mutable scripts from `cli.oomol.com` and immediately pass their contents to a shell interpreter. The Bash command pipes the HTTP response directly into `bash`, while the PowerShell command evaluates the downloaded response with `Invoke-Expression`. Neither installation path pins a version, verifies a cryptographic signature or checksum, stages the script for inspection, or confirms its contents before execution. HTTPS protects the transport channel but cannot establish that the remote server continues to provide the same reviewed script. A compromised hosting server, publishing account, DNS path, or build and deployment process could therefore replace the installer with arbitrary code. Installing a CLI may be relevant to first-time setup, but immediate execution of unverified remote content is not necessary for the Skill's declared read-only Lightfield operations and exceeds minimum-privilege expectations. The reviewed file contains no evidence that the remote installers are themselves currently malicious; the vulnerability is that their effective payload can change after the Skill has been reviewed. ### Attack Path 1. The `oo` CLI is unavailable, causing the user or agent to follow the first-time setup instructions. 2. An attacker compromises or gains control over the installer endpoint, its publishing pipeline, hosting account, or another trusted delivery component. 3. The attacker replaces the expected installer response with a malicious shell or PowerShell payload. 4. The user or agent runs the documented i ...[truncated 1021 chars]
- Remediation
- ## Remediation Suggestions 1. Remove both download-to-interpreter pipelines from the setup instructions. 2. Prefer a trusted operating-system package manager or official package repository, and pin the CLI to an explicitly reviewed version. 3. If direct installation artifacts must be supported: - Download a versioned artifact to a local file without executing it. - Publish its expected SHA-256 digest through an independent trusted channel. - Verify the digest before execution. - Prefer a cryptographic signature from a documented release-signing key. - Abort installation if any verification step fails. 4. Display the verified script or package metadata for inspection and require explicit user approval before execution. 5. Run installation with ordinary user privileges unless a documented operation strictly requires elevation. Do not request blanket administrator or root access. 6. Keep installation outside automated Skill execution. The Skill should report that the CLI is missing and direct the user to verified, versioned installation documentation. 7. Document the installer's expected filesystem, network, and configuration changes so users can assess its required privileges. 8. Pin referenced installation documentation or release artifacts to immutable versions so the executable content cannot change silently after review.