T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:70
- Finding
- Unverified Remote Installer Download and Immediate Shell Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 70–74 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from `cli.oomol.com` and pass them directly to Bash or PowerShell. Neither command pins a release, verifies a cryptographic checksum or digital signature, nor gives the user an opportunity to inspect the downloaded script before execution. HTTPS provides transport protection but does not establish that the script remains identical to the version assessed during this audit. If the hosting infrastructure, DNS resolution, publishing pipeline, or maintainer account is compromised—or if the remote script is maliciously modified—the changed payload will execute immediately. Installing the `oo` CLI may support the Skill's declared Salesflare integration, but executing an unverified remote script is not the minimum-risk method of installation. The exposure is conditional because the instructions say to use this fallback only when `oo` is unavailable, but that condition does not mitigate the integrity risk once installation occurs. The separate network behavior used by `oo connector run` is consistent with the declared connector functionality: Salesflare payloads must be sent through OOMOL to the Salesflare service. The audited file does not demonstrate unrelated data exfiltration or local credential harvesting. ### Attack Path 1. A user or Agent attempts to use the Skill on a system where the `oo` CLI is not installed. 2. The command fails with `oo: command not found`. 3. The Agent or user follows the documented first-time setup instructions. 4. An attacker has altered the installer through compromise of the hosting se ...[truncated 1217 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the direct `curl | bash` and `irm | iex` installation patterns. 2. Prefer a trusted operating-system package manager or a version-pinned installer obtained from a documented release. 3. Download the installer to a local file rather than executing the response stream immediately. 4. Publish a SHA-256 or stronger digest through an independently protected channel and verify it before execution. 5. Prefer signed release artifacts and validate the signature against a pinned, documented publisher key. 6. Display the resolved version, source URL, checksum, and requested privileges before requesting explicit user approval. 7. Run installation with ordinary user privileges whenever possible; do not use `sudo` or elevated PowerShell unless a specific installation step requires it. 8. Pin the CLI version used by the Skill and document a controlled update procedure so later remote changes cannot silently alter the reviewed payload. 9. Retain the existing conditional setup behavior so installation is not triggered when the CLI is already available.