T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:57
- Finding
- Unverified Remote Installer Is Executed Directly by a Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 57-65 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```markdown - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The installation instructions download mutable content from an external OOMOL-controlled URL and immediately execute it using `bash` or PowerShell's `Invoke-Expression`. Neither command pins an installer version nor verifies a cryptographic signature or checksum before execution. Consequently, the code ultimately executed is not fixed by the reviewed Skill package and can change after this audit. Compromise of the installer host, its deployment pipeline, its account, or the network trust chain could turn these instructions into an arbitrary-code execution channel. The conditional placement under first-time setup reduces how often the path is reached, but does not address the underlying trust problem. Installing a supporting CLI may be necessary for the declared functionality; executing an unverified remote response directly in a shell is not the minimum privilege or safest installation method required to accomplish that task. ### Attack Path 1. The `oo` CLI is absent, causing an `oo: command not found` failure. 2. The Agent or user follows the documented first-time setup instructions. 3. The shell retrieves `install.sh` or `install.ps1` from the external server. 4. The remote response is passed directly to `bash` or `iex` without inspection or integrity verification. 5. If the remote host, publication pipeline, or served installer is compromised, attacker-controlled commands execute under the invoking account. 6. Those commands can access ...[truncated 748 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove both pipe-to-shell installation commands. 2. Distribute the CLI through a trusted platform package manager or a version-pinned release artifact. 3. Download the installer or binary to a local file without executing it immediately. 4. Publish a cryptographic checksum and, preferably, a signature from a separately protected trust channel. 5. Verify the checksum and signature locally before execution. 6. Display the artifact location and require explicit user approval before running it. 7. Pin the expected CLI version so the effective installation payload cannot change silently after review. 8. Document the permissions and filesystem changes required by the installer. 9. Prefer installation without administrative privileges, and clearly warn the user before any necessary elevation. ]]>