T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:58
- Finding
- Unverified Remote Installer Scripts Executed Directly by Shells<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 58–62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions download scripts from `cli.oomol.com` and immediately execute the returned content using Bash or PowerShell. They do not pin an installer version, verify a cryptographic checksum or publisher signature, or provide an opportunity to inspect the downloaded script before execution. Although HTTPS protects the connection in transit, it does not ensure that the remotely hosted payload remains unchanged after this Skill has been reviewed. Compromise of the hosting server, CDN, DNS infrastructure, TLS termination environment, or publisher account could cause arbitrary attacker-controlled code to be returned and executed. Installation of the `oo` CLI is ancillary setup rather than a Product Fruits read operation. Automatically executing a mutable remote installer therefore grants substantially more privilege than the Skill's declared read-only connector functionality requires. ### Attack Path 1. The agent attempts to invoke an `oo` connector command. 2. The command fails because the `oo` CLI is not installed. 3. The agent follows the first-time setup instructions in `SKILL.md`. 4. `curl` or `Invoke-RestMethod` retrieves the current installer from `cli.oomol.com`. 5. The response is passed directly to Bash or `Invoke-Expression`. 6. If the remote response has been compromised or maliciously changed, attacker-controlled commands execute with the privileges of the user running the agent. ### Impact Assessment Successful exploitation permits arbitrary code execution under the invoking user's account. Depending on that account's permissions and the delivered pa ...[truncated 670 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove direct `curl | bash` and `Invoke-RestMethod | Invoke-Expression` installation patterns. 2. Pin the CLI to a reviewed, explicit version rather than retrieving an unversioned mutable installer. 3. Download the installer or package to a local file without executing it immediately. 4. Publish an expected SHA-256 or stronger checksum through an independently protected channel and verify it before execution. 5. Verify a platform-appropriate publisher signature, such as a signed package, Authenticode signature, or Sigstore provenance. 6. Prefer an official package manager that supports signed repositories and version pinning. 7. Require the user to approve the installation explicitly rather than allowing an agent to perform it automatically after a command failure. 8. Execute installation with ordinary user privileges unless a documented component strictly requires elevation. 9. Document the files, network endpoints, and permissions used by the installer so users can evaluate its effects. 10. If a script-based installer remains necessary, use a hardened workflow similar to: ```bash curl -fSLo oo-install.sh \ https://cli.oomol.com/releases/<pinned-version>/install.sh echo "<trusted-sha256> oo-install.sh" | sha256sum --check - less oo-install.sh bash oo-install.sh ``` The checksum must be obtained from a trusted, separately authenticated release channel rather than from the same mutable installer endpoint. ]]>