T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:55
- Finding
- Unverified Remote Installation Scripts Executed Directly by the Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 55–59 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from an external server and immediately execute the returned content through `bash` or PowerShell's `Invoke-Expression`. The instructions do not pin an installer version, verify a cryptographic signature or checksum, save the script for inspection, or otherwise establish the integrity of the executed payload. HTTPS protects data in transit but does not make the remote payload immutable or protect users if the hosting service, publisher account, DNS infrastructure, TLS termination point, or release process is compromised. Because the effective executable content can change after the Skill has been reviewed, an upstream compromise could turn these documented installation commands into an arbitrary-code-execution channel. Installing software is not required for the Skill's normal Meituan query operation when the `oo` CLI is already available. Automatically following this fallback therefore grants a remote installer broader system access than the declared read-only travel-query functionality itself requires. ### Attack Path 1. A Meituan action is requested on a system where the `oo` CLI is unavailable. 2. The command fails with `oo: command not found`. 3. The Agent or user follows the first-time setup instructions in `SKILL.md`. 4. `curl` or `Invoke-RestMethod` retrieves the current installer from `cli.oomol.com`. 5. The downloaded response is passed directly to `bash` or `Invoke-Expression` without integrity verification or review. 6. If the remote installer or its delivery infrastructure has been compromised, attacker- ...[truncated 998 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove both pipe-to-shell installation commands from the Skill instructions. 2. Direct users to a trusted package manager or a version-pinned release artifact from the official publisher. 3. Download the installer to a local file without executing it immediately. 4. Publish and require verification of a cryptographic signature and a SHA-256 checksum obtained through an independently protected channel. 5. Allow the user to inspect the downloaded script before execution. 6. Require explicit user approval before installing software or making system-level changes; do not let an authentication or command-not-found fallback silently trigger installation. 7. Run installation with the lowest necessary privileges and explicitly warn users not to use an elevated shell unless a documented installation step strictly requires it. 8. Apply the same integrity, review, version-pinning, and consent controls to both the macOS/Linux and Windows installation paths. A safer workflow is: select a fixed release version, download its artifact, verify its publisher signature and pinned checksum, display the verified artifact and intended changes to the user, obtain explicit confirmation, and only then execute it. ]]>