T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:62
- Finding
- Unverified Remote Installer Scripts Executed Directly by the Shell## Vulnerability Details **File Location**: `SKILL.md`, lines 62–66 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable scripts from external URLs and immediately execute their contents with `bash` or PowerShell's `Invoke-Expression`. The scripts are not pinned to an immutable release, downloaded for inspection, or validated using a cryptographic signature or checksum. Although the download domain corresponds to the declared CLI provider and installation is relevant when the required CLI is absent, immediate execution of unverified remote content is not the minimum safe mechanism needed to install the dependency. The effective code can change after the skill has been reviewed. Compromise of the hosting service, DNS resolution, TLS termination, or the provider's release pipeline could cause arbitrary attacker-controlled commands to execute. The same exposure exists if the external service intentionally or accidentally serves unexpected content. ### Attack Path 1. The `oo` CLI is unavailable and an authentication or connection action triggers the documented first-time setup process. 2. The user or agent runs one of the provided installation commands. 3. The command retrieves the current script from `cli.oomol.com`. 4. An attacker who has compromised the delivery infrastructure causes the endpoint to return a modified installer. 5. The pipe sends the response directly to `bash` or `iex`, without prior inspection or integrity verification. 6. The malicious script executes with all privileges available to the invoking shell. ### Impact Assessment Successful exploitation provides arbitrary command execution under the acc ...[truncated 598 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `curl | bash` and `irm | iex` installation patterns. 2. Prefer a trusted operating-system package manager or authenticated package repository with a version-pinned CLI release. 3. If direct download is required, download the installer or binary to a local file without executing it. 4. Publish a cryptographic checksum and preferably a signature through an independently authenticated channel. 5. Verify the checksum and signature before execution, and abort installation on any mismatch. 6. Pin the download to an immutable versioned release rather than a mutable `install.sh` or `install.ps1` endpoint. 7. Display the exact file, version, source, and expected privileges to the user and require explicit approval before installation. 8. Run installation with the least privileged account possible and avoid administrator or root execution unless demonstrably required. 9. Document a manual review workflow so users can inspect the downloaded script before invoking it.