T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:58
- Finding
- Unverified Remote Installer Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 58–62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical The first-time setup instructions contain the following vulnerable commands: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis Both commands retrieve mutable code from an external server and immediately pass it to a command interpreter. The downloaded content is not included in the audited project, pinned to a specific version, verified against a cryptographic digest, or authenticated through a separately validated publisher signature. Although `cli.oomol.com` is consistent with the declared OOMOL publisher, domain ownership alone does not make direct remote execution safe. Compromise of the hosting infrastructure, release account, DNS resolution, TLS termination, or installer publication process could cause different code to be delivered after this Skill has been reviewed. Immediate piping also prevents meaningful inspection before execution. The remote script inherits the privileges and environment of the user running Bash or PowerShell. Installing the CLI is a one-time setup activity rather than part of normal Mixmax operations, so unrestricted execution of a mutable installer exceeds the minimum privileges necessary for routine Skill use. ### Attack Path 1. A Mixmax operation fails because the `oo` CLI is unavailable. 2. The agent or user follows the documented first-time setup procedure. 3. An attacker compromises a relevant delivery component, such as the installer host, publishing account, DNS/TLS path, or release pipeline. 4. The attacker replaces or modifies `install.sh` or `install.ps1` with malicious commands. 5. `curl` or `irm` retrieves the attacker-controlled response. 6. Bash or PowerShell executes ...[truncated 994 chars]
- Remediation
- ## Remediation Suggestions 1. Remove both pipe-to-shell installation commands from the Skill instructions. 2. Distribute a version-pinned CLI package or installer through a documented package manager or immutable release URL. 3. Require the installer to be downloaded to a local file before execution rather than passing the network response directly to a shell. 4. Publish a SHA-256 or stronger cryptographic digest through a separately protected channel and verify it before execution. 5. Sign release artifacts with a documented publisher key and require signature verification. 6. Provide explicit inspection and execution steps, for example: download, verify the signature and digest, review the artifact, and only then execute it. 7. Ensure installation uses ordinary user privileges unless a narrowly scoped operation explicitly requires elevation. 8. Pin documentation to a specific tested CLI version and document a controlled update procedure. 9. Prefer directing users to an installation guide over allowing an agent to perform installation automatically.