T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:91
- Finding
- Unverified Remote Installation Scripts Executed Directly by the Shell## Vulnerability Details **File Location**: `SKILL.md`, lines 91–95 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions download scripts from external URLs and immediately execute the returned content through Bash or PowerShell. Neither command pins the downloaded artifact to a reviewed version nor verifies a cryptographic signature or checksum before execution. Consequently, the effective code executed by these instructions can change after the Skill has been audited. HTTPS provides transport protection but does not guarantee that the remote script remains unchanged or safe if the hosting account, server, DNS infrastructure, certificate issuance process, or delivery pipeline is compromised. Installing the CLI may be relevant to first-time setup, but executing an unverified network response is not the minimum privilege or safest mechanism required for that purpose. The behavior creates a remote code-execution channel controlled by infrastructure outside the audited project. ### Attack Path 1. The `oo` CLI is unavailable, causing an Agent or user to consult the first-time setup section. 2. An attacker compromises or gains control over the remote script, hosting infrastructure, DNS resolution, or release pipeline. 3. The attacker modifies the installation response to include malicious shell commands. 4. The user or Agent runs the documented `curl | bash` or `irm | iex` command. 5. The shell executes the attacker-controlled response immediately, without integrity verification or prior inspection. 6. The payload operates with the privileges of the invoking user and may access any resources available to that account. ### Impact Assessm ...[truncated 886 chars]
- Remediation
- ## Remediation Suggestions 1. Remove both direct download-and-execute pipelines from the Skill instructions. 2. Prefer installation through a trusted operating-system package manager or a platform-native, independently verifiable package repository. 3. Pin installation artifacts to an explicit version rather than retrieving a mutable latest-version script. 4. Publish SHA-256 or stronger checksums through a separately protected channel and verify the downloaded artifact before execution. 5. Cryptographically sign release artifacts and require signature validation against a documented, pinned publisher key. 6. Split downloading from execution so the artifact can be inspected before it is run. 7. Require explicit user approval before installing software; an Agent should not perform installation automatically after a command failure. 8. Run installation with ordinary user privileges unless elevated privileges are demonstrably necessary. Do not recommend `sudo`, administrator shells, or equivalent elevation by default. 9. Document the destination paths, files created, permissions requested, network endpoints contacted, and uninstall procedure. 10. If a bootstrap script remains unavoidable, pin its immutable digest or release URL, verify it before execution, and fail closed when verification is unsuccessful.