T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:59
- Finding
- Unverified Remote Installation Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 59–63 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable scripts from `cli.oomol.com` and immediately execute them using Bash or PowerShell. They do not pin a release version, verify a cryptographic signature or checksum, save the scripts for inspection, or request explicit approval before execution. Although these commands are presented as first-time fallback steps when the `oo` CLI is unavailable, direct remote-to-shell execution is not necessary for the Skill's Neutrino API functionality. A versioned and independently verified installation artifact would provide the required CLI without creating an unrestricted remote code-execution channel. The effective code executed by these commands can change after the Skill package has been audited. The repository contains no local copy of the installation scripts, so their behavior cannot be established from the audited artifact. This does not prove that the current scripts are malicious, but it creates a critical supply-chain trust boundary. ### Attack Path 1. A user attempts to use the Skill on a system where the `oo` command is unavailable. 2. The documented fallback instructs the user or agent to retrieve an installation script from `cli.oomol.com`. 3. An attacker compromises the hosting service, publication process, domain, DNS/TLS trust path, or another component capable of changing the returned script. 4. The altered script is streamed directly into Bash or PowerShell. 5. The shell executes the attacker-controlled instructions before the user can inspect or validate them. 6. The payload operates with all permissions available t ...[truncated 731 chars]
- Remediation
- ## Remediation Suggestions 1. Remove both direct pipe-to-shell installation commands. 2. Direct users to an official, versioned release page or trusted platform package manager. 3. Pin the CLI to a specific reviewed version rather than downloading a mutable latest installer. 4. Publish SHA-256 checksums and preferably cryptographic signatures for installation artifacts. 5. Download the artifact to a local file, verify its checksum or signature, and only then execute or install it. 6. Display the exact artifact, version, source, and intended changes before installation and obtain explicit user approval. 7. Prefer a minimally privileged installation location and warn users not to run the installer as an administrator unless independently necessary. 8. Keep installation outside normal Skill execution; if `oo` is missing, return a clear error and verified manual installation guidance rather than executing remote setup code automatically.