T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:59
- Finding
- Unpinned Remote Installer Downloaded and Executed Directly<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 59–68 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The Skill directs users to retrieve mutable installation scripts from an external server and execute them immediately through Bash or PowerShell. Neither command pins the installer to a reviewed version nor verifies a cryptographic checksum or digital signature. Users also have no opportunity to inspect the downloaded content before execution. HTTPS protects the transport connection but does not make the remote payload immutable. If the hosting service, DNS resolution, publishing account, build pipeline, or installer itself is compromised, the commands will execute the substituted payload with the invoking user's privileges. The effective code can also change after the Skill has been reviewed. The installation behavior is not required for normal MeetGeek read operations because the Skill explicitly assumes that the CLI is already installed. Although installation is presented only as an error-recovery step, arbitrary remote script execution exceeds the minimum privilege necessary to retrieve meeting information. The Skill also sends action payloads to the OOMOL `meet_geek` connector. That network communication is consistent with its declared connector functionality, and the reviewed file contains no evidence that credentials or meeting content are transmitted to unrelated endpoints. ### Attack Path 1. The `oo` command is unavailable, causing the documented first-time setup path to be used. 2. The user or agent runs the provided `curl | bash` or ...[truncated 1148 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove direct `curl | bash` and `irm | iex` installation instructions. 2. Prefer an official package manager or a version-pinned release artifact from a documented release page. 3. Pin the CLI to a specific reviewed version rather than retrieving an indefinitely mutable installer. 4. Publish cryptographic checksums or signed release manifests through a separate trusted channel and require verification before execution. 5. Download the installer to a local file first, for example using restrictive file permissions, and allow the user to inspect it before running it. 6. Require explicit user approval before executing any installer, even when installation follows a command-not-found error. 7. Run installation with ordinary user privileges and avoid elevation unless a specific installation step demonstrably requires it. 8. Document the files, directories, network endpoints, and configuration changes made by the installer. 9. Keep the normal Skill workflow limited to the existing `Bash(oo *)` tool allowance and do not automatically broaden execution permissions to arbitrary shell commands. ]]>