T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:58
- Finding
- Unverified Remote Installer Download and Immediate Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 58–62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical The first-time setup instructions provide commands that download mutable scripts from an external server and execute them immediately: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis Both installation commands create a direct remote-code-execution channel: - On macOS and Linux, `curl` streams the server response directly into `bash`. - On Windows, `Invoke-RestMethod` (`irm`) retrieves the response and passes it directly to `Invoke-Expression` (`iex`). - Neither command pins a release, verifies a cryptographic signature or checksum, nor permits inspection before execution. - HTTPS protects transport integrity under normal conditions, but it does not establish that every future response from the endpoint is trustworthy. - The effective payload can change after the Skill has been reviewed. Compromise of the hosting service, publication pipeline, domain, DNS/TLS path, or associated administrative account could turn the documented installation command into arbitrary code execution. The instructions only recommend these commands when the CLI is unavailable, which reduces how often they are invoked but does not eliminate the execution risk. Remote installation is also not necessary for the Skill's normal read operations when the CLI is already installed, and automatically executing an unverified installer exceeds the minimum privilege required to document the setup process. ### Attack Path 1. The `oo` CLI is not installed, causing a command to fail with `oo: command not found`. 2. The Agent or user follows the documented first-time setup instructions. 3. The command retrieves the current contents of the external inst ...[truncated 1290 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all direct `curl | bash` and `irm | iex` installation patterns. 2. Direct users to a trusted, versioned package manager or pinned release artifact from an authoritative distribution channel. 3. Download the installer to a local file without executing it automatically. 4. Pin an explicit CLI and installer version rather than retrieving an unversioned mutable script. 5. Publish and verify a SHA-256 checksum obtained through a separately authenticated channel. 6. Prefer cryptographic signature verification using a documented vendor signing key before execution. 7. Allow the user to inspect the downloaded file and require explicit approval before running it. 8. Execute the installer with ordinary user privileges unless a documented operation strictly requires elevation. 9. Apply equivalent download, pinning, signature-verification, inspection, and approval controls to both the Unix and Windows installation paths. 10. Keep installation outside normal connector execution so Smartlead read actions never trigger software installation automatically.