T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:57
- Finding
- Unverified Remote Installer Downloaded and Executed Directly## Vulnerability Details **File Location**: `SKILL.md:57-61` **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions pipe content retrieved from an external URL directly into Bash or PowerShell. The downloaded payload is not version-pinned, inspected, or validated with a cryptographic signature or checksum before execution. Consequently, the effective code can change after the Skill package has been reviewed. HTTPS protects the connection in transit but does not guarantee that the remote server, CDN, DNS infrastructure, publishing pipeline, or installer artifact remains trustworthy. If any of those components are compromised, arbitrary commands supplied by the attacker would be executed immediately. Installing a remote executable also exceeds the minimum privileges needed for the Skill's core function, which is limited to read-only Stormglass tide and weather queries. While installing the required CLI may be operationally necessary, unattended pipe-to-shell execution is not the least-risk installation method. ### Attack Path 1. The `oo` CLI is absent, causing the documented first-time setup procedure to be used. 2. An attacker compromises or gains control over the installer hosting infrastructure, DNS resolution, CDN, or release pipeline. 3. The attacker replaces `install.sh` or `install.ps1` with a malicious payload. 4. The user or Agent runs the documented installation command. 5. Bash or PowerShell executes the response without integrity verification or prior review. 6. The payload performs arbitrary actions under the privileges of the invoking process. ### Impact Assessment Successful exploitation provides arbitrary command executi ...[truncated 590 chars]
- Remediation
- ## Remediation Suggestions 1. Remove direct `curl | bash` and `irm | iex` installation instructions. 2. Prefer installation through a trusted operating-system package manager using a version-pinned package. 3. If a standalone installer is required, download it as a file without executing it immediately. 4. Pin the installer or release to a specific immutable version. 5. Publish an expected SHA-256 or stronger digest through a separately protected release channel and verify it before execution. 6. Prefer cryptographic signature verification using a documented, pinned publisher key. 7. Require explicit user approval before installing software or running any downloaded executable. 8. Document the installer's expected files, network destinations, permissions, and whether privilege elevation is required. 9. Execute the installer with ordinary user privileges unless a narrowly defined operation demonstrably requires elevation. 10. Abort installation if download, signature, checksum, or provenance verification fails.