T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:59
- Finding
- Unverified Remote Installer Download and Immediate Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 59–63 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The setup instructions pipe remotely downloaded content directly into a command interpreter. The Unix command sends the response from `curl` to Bash, while the Windows command uses `Invoke-RestMethod` and `Invoke-Expression` to execute the downloaded PowerShell content. The remote payload is not version-pinned, inspected, cryptographically signed, or checked against a trusted digest before execution. Consequently, the effective code can change after the Skill package has been reviewed. HTTPS protects the transport channel but does not mitigate compromise of the hosting infrastructure, publishing account, DNS or certificate trust chain, or installer itself. Installing the required CLI may be legitimate, but immediate execution of mutable network content exceeds the minimum privilege necessary to provide installation guidance. The Skill can instead direct users to a pinned, verifiable release and require explicit approval before installation. ### Attack Path 1. A PredictLeads action fails because the `oo` CLI is unavailable. 2. The agent or user follows the first-time setup instructions in `SKILL.md`. 3. The command retrieves the current installer from `cli.oomol.com`. 4. Bash or PowerShell executes the response immediately without prior inspection or integrity verification. 5. If the installer source or delivery chain has been compromised, attacker-controlled code runs with the privileges of the invoking user. 6. That code can access resources available to the user and may attempt additional downloads, system modification, credential access, or pers ...[truncated 704 chars]
- Remediation
- ## Remediation Suggestions 1. Remove direct `curl | bash` and `irm | iex` execution patterns. 2. Pin installation instructions to a reviewed CLI version rather than a mutable installer endpoint. 3. Download the release artifact to a local file without executing it automatically. 4. Publish and verify a cryptographic signature from a separately established trust key, or verify a pinned SHA-256 digest before execution. 5. Prefer a trusted operating-system package manager or a signed platform-native package where available. 6. Display the resolved artifact version, source, checksum, and intended changes to the user. 7. Require explicit user approval before installing software or running the verified installer. 8. Run installation with ordinary user privileges unless a documented operation specifically requires elevation. 9. Fail safely if signature or digest verification fails; do not fall back to executing an unverified payload. A safer Unix workflow would follow this general sequence: ```bash curl -fL --output oo-installer.sh "https://trusted.example/oo/<pinned-version>/install.sh" printf '%s %s\n' '<trusted-sha256>' 'oo-installer.sh' | sha256sum --check - less oo-installer.sh bash oo-installer.sh ``` The artifact URL and digest must be pinned to a reviewed release, and signature verification is preferable to relying only on a digest distributed through the same channel.