T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:55
- Finding
- Unverified Remote Installation Scripts Executed Directly by Shell<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 55–64 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```markdown - **`oo: command not found`** — install the oo CLI (other platforms: <https://cli.oomol.com/install-guide.md>): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The installation instructions download mutable scripts from `cli.oomol.com` and immediately execute them using Bash or PowerShell. Neither installation path pins a script version, verifies a cryptographic signature or published checksum, nor allows inspection before execution. Consequently, the code ultimately executed is not contained in the audited project and can change after this Skill has been reviewed. HTTPS protects transport against ordinary interception but does not protect against compromise of the vendor host, DNS or distribution infrastructure, unauthorized modification of the hosted scripts, or a malicious future release. The instructions also exceed the Skill's declared runtime tool boundary of `allowed-tools: [Bash(oo *)]`: installation requires running `curl`, a shell interpreter, and arbitrary commands selected by the downloaded script rather than only invoking the approved `oo` command. Installation is not necessary for normal analytics operations when the documented assumption—that the CLI is already installed—is satisfied. The project contains no local installer, package lockfile, pinned release artifact, checksum, or signature with which the remote payload can be independently validated. ### Attack Path 1. The `oo` CLI is genuinely absent, or execution is made to fail with a command-not-found condition. 2. The user or agent follows the first-time setup instructions in `SKILL.md`. 3. `curl` or `irm` retrieves the cur ...[truncated 1439 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove both direct execution pipelines: - Do not pipe `curl` output into `bash`. - Do not pipe `Invoke-RestMethod` output into `Invoke-Expression`. 2. Keep dependency installation outside automated Skill execution. Direct users to a separately documented installation procedure and require explicit approval before installing software. 3. Distribute the CLI through a trusted platform package manager or a versioned official release artifact. 4. Pin the CLI to a specific, reviewed version rather than retrieving a mutable generic installation endpoint. 5. Publish and require verification of a cryptographic signature or a SHA-256 digest obtained through an independently authenticated channel. 6. Download the artifact to disk first, verify its expected domain, exact version, signature, and checksum, and permit inspection before executing it. 7. Document the installer's required filesystem, network, and privilege effects. Ensure it does not request administrator or root access unless strictly necessary and explicitly approved. 8. Preserve the declared tool boundary by allowing routine Skill operation to invoke only the installed `oo` CLI. Do not permit the Skill to invoke general-purpose downloaders or interpreters for installation. 9. If automated installation is unavoidable, vendor a small, reviewable installer in the repository, pin all fetched artifacts, fail closed on verification errors, and avoid executing content received directly from the network. ]]>