T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:63
- Finding
- Unverified Remote Installer Execution Through Shell Pipelines<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 63–67 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The setup instructions download scripts from `cli.oomol.com` and immediately execute their contents with `bash` or PowerShell's `Invoke-Expression` (`iex`). The downloaded payload is not displayed, pinned to an immutable version, verified against a cryptographic checksum, or authenticated using a package signature before execution. Consequently, the code that will execute can change after this skill has been audited. Compromise of the hosting server, its deployment process, DNS resolution, TLS termination, or the installer itself could turn the documented installation command into an arbitrary-code-execution channel. Installation is ancillary to the skill's declared read-only Pexels functionality. The primary operations only require invoking an already-installed `oo` CLI through `oo connector schema` and `oo connector run`. Executing an unrestricted remote installer with all permissions of the current user therefore exceeds the minimum privileges required to search or retrieve Pexels data. The instructions limit installation to a first-time setup path after an `oo: command not found` error, which reduces exposure. HTTPS also provides transport protection under normal conditions. However, neither measure verifies the identity and integrity of the final script payload independently of the remote infrastructure. The separate network behavior used by `oo connector run` is consistent with the declared connector functionality: search terms, resource identifiers, and connector requests must be sent to the remote service to retrieve Pexels data. The reviewed file states that credentials ...[truncated 2032 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove direct `curl | bash` and `irm | iex` installation commands. 2. Prefer a signed, version-pinned package distributed through a trusted package manager. 3. If script-based installation is unavoidable: - Pin the download to a specific immutable release. - Download the script to a local file instead of executing the response directly. - Publish a SHA-256 or stronger checksum through a separate trusted channel. - Verify the checksum and, preferably, a cryptographic signature before execution. - Allow the user to inspect the downloaded script. - Execute it only after explicit user approval. 4. Do not let the skill automatically install software after a command failure. Return a clear error and direct the user to a reviewed installation guide. 5. Run installation with ordinary user privileges and avoid elevation unless a specific operation demonstrably requires it. 6. Document the files, network endpoints, and configuration changes performed by the installer. 7. Keep the skill's runtime permissions restricted to `oo` CLI invocations. The declared `Bash(oo *)` boundary should not be broadened to permit general shell commands merely to support installation. A safer POSIX workflow would resemble: ```bash curl -fSLo oo-install.sh "https://cli.oomol.com/releases/<pinned-version>/install.sh" echo "<published-sha256> oo-install.sh" | sha256sum --check - less oo-install.sh bash oo-install.sh ``` An equivalent PowerShell workflow should use `Invoke-WebRequest -OutFile`, verify an Authenticode signature or published cryptographic hash, request explicit approval, and only then execute the local file. ]]>