T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:62
- Finding
- Unverified Remote Installation Scripts Executed Directly by Shells<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 62–66 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions pipe content retrieved from remote HTTPS endpoints directly into Bash or PowerShell. The downloaded scripts are executed without first being saved for inspection and without verifying a pinned version, cryptographic checksum, or digital signature. HTTPS protects data in transit under normal conditions, but it does not establish that the script is immutable or safe. If the distribution server, hosting account, DNS resolution, certificate trust chain, or release process is compromised, the endpoint can return attacker-controlled commands. The effective payload can also change after the Skill has been reviewed. This behavior is broader than the Skill's declared read-only PubMed functionality. Searching and retrieving PubMed records does not inherently require arbitrary remote code execution. Although installation is presented as a fallback for a missing CLI, following these instructions gives the remote script all permissions held by the invoking user. ### Attack Path 1. The `oo` CLI is unavailable, causing the user or agent to follow the first-time setup instructions. 2. The installer endpoint or its software-delivery infrastructure is compromised, or the endpoint begins serving a malicious script. 3. `curl` or `Invoke-RestMethod` retrieves the mutable script. 4. The pipe passes the response directly to `bash` or `Invoke-Expression`, with no opportunity for validation. 5. The shell executes the attacker's commands with the invoking user's privileges. 6. The payload can access user-readable information, modify user-writable files, install additional soft ...[truncated 982 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove both direct remote-script execution patterns: - Do not pipe `curl` output into `bash`. - Do not pass `Invoke-RestMethod` output directly to `Invoke-Expression`. 2. Prefer a trusted platform package manager or a signed, version-pinned release artifact from the official project repository. 3. If a standalone installer is unavoidable: - Pin the installer or binary to a specific release version. - Download it to a local file without executing it. - Publish and verify a cryptographic SHA-256 or stronger checksum over an authenticated channel. - Verify a platform-appropriate digital signature from a documented publisher. - Abort installation if any verification fails. - Allow the user to inspect the downloaded content before execution. 4. Avoid requesting administrator or root privileges unless a documented installation step strictly requires them. Prefer installation into a user-owned directory with minimal filesystem access. 5. Provide manual installation instructions and clearly disclose the files, directories, environment variables, and network endpoints affected by installation. 6. Keep installation outside routine Skill execution. The Skill should report that the dependency is missing and require an explicit user decision before any installation action. ]]>