T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:58
- Finding
- Unverified Remote Installer Download and Immediate Shell Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 58–62 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable scripts from `cli.oomol.com` and immediately execute them through Bash or PowerShell. The downloaded content is not pinned to a specific release, saved for inspection, authenticated with a publisher signature, or checked against a known cryptographic hash. HTTPS provides transport protection but does not establish that the script remains unchanged after the Skill has been audited. A compromised hosting account, web server, release process, or domain could replace the installer with arbitrary code. The effective executable payload is therefore controlled by remote infrastructure at invocation time and cannot be determined from the reviewed project. The installation behavior also exceeds the minimum runtime privileges needed to invoke the declared StealthGPT connector. Although installing the required CLI may be necessary during initial setup, executing an unverified remote script is not necessary; a pinned and independently verified package can provide the same functionality. ### Attack Path 1. The `oo` command is unavailable, causing the Agent or user to follow the first-time setup instructions. 2. The shell retrieves the current contents of `install.sh` or `install.ps1` from the remote server. 3. The response is piped directly into Bash or `Invoke-Expression`, without local review or integrity verification. 4. If the distribution infrastructure or installer has been maliciously modified, attacker-controlled commands execute with the privileges of the invoking user. 5. The payload can access user-readable data, modify user-owned files an ...[truncated 835 chars]
- Remediation
- ## Remediation Suggestions 1. Remove both direct execution pipelines (`curl | bash` and `irm | iex`). 2. Pin installation instructions to a specific, immutable CLI release and version. 3. Download the installer or package to a local file without executing it automatically. 4. Publish and require verification of a hard-coded SHA-256 or stronger checksum obtained through an independently protected channel. 5. Prefer signed platform packages and verify the publisher signature before installation. 6. Allow the user to inspect the downloaded artifact and require explicit approval before execution. 7. Run installation with ordinary user privileges unless a documented operation strictly requires elevation. 8. Document the files, permissions, subprocesses, and network endpoints used by the installer. 9. For automated Agent workflows, stop when the CLI is missing and provide safe manual installation guidance rather than executing a remote installer. 10. Consider distributing the CLI through reputable, version-pinned package managers with signature and provenance verification.