T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:58
- Finding
- Unverified Remote Installation Scripts Are Executed Directly## Vulnerability Details **File Location**: `SKILL.md`, lines 58-62 **Vulnerability Type**: Remote payload retrieval and immediate execution **Risk Level**: High The first-time setup instructions execute remotely hosted installation scripts directly in local command interpreters: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis Both installation methods combine payload retrieval and execution into a single operation. The downloaded scripts are not pinned to an immutable version and are not checked against a trusted cryptographic signature or checksum before execution. Although HTTPS protects the connection in transit under normal conditions, it does not guarantee that the content hosted at these URLs will remain unchanged after the Skill has been audited. A compromise of the hosting infrastructure, publishing credentials, DNS or certificate environment, or the legitimate distribution pipeline could cause arbitrary replacement content to be executed. This behavior exceeds the minimum privileges required to query Meta data. The declared functionality only requires an already installed CLI to invoke connector actions. Installing software by executing mutable remote code is a separate, security-sensitive operation and should not occur without payload verification and explicit user approval. ### Attack Path 1. The `oo` command is unavailable, causing the agent or user to follow the first-time setup instructions. 2. An attacker compromises the remote installation endpoint or its deployment pipeline and replaces the installer with malicious shell or PowerShell code. 3. The documented `curl | bash` or `irm | iex` command retrieves the current attacker-controlled response. 4. The response is passed directly to the local interpreter without inspection, version pinning, checksum v ...[truncated 1378 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the direct `curl | bash` and `irm | iex` installation commands from the Skill. 2. Treat installation as a separate operation requiring explicit user approval rather than an automatic fallback during Meta requests. 3. Pin the CLI to a specific immutable release and download it from a verifiable official release location. 4. Publish a cryptographic checksum for each platform artifact and verify it locally before execution or installation. 5. Prefer signed packages and verify the publisher signature using a trusted key distributed through an independent channel. 6. Download the artifact to a local file first so its origin, checksum, signature, and contents can be inspected before execution. 7. Use a trusted platform package manager where available, with a version constraint and signature-verification support. 8. Run installation with ordinary user privileges unless a documented operation strictly requires elevation. Do not request broad administrative privileges by default. 9. Document the files, executables, network endpoints, and configuration changes introduced by the installer. 10. Keep the current instruction to assume the CLI is already installed, but on failure provide verified manual installation guidance instead of executing remote code.