T03 · Remote Payload Retrieval and Execution
Error
- Location
SKILL.md:58- Finding
Unverified Remote Installer Download and Immediate Execution
- Content
View full analysis
): ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ``` ### Technical Analysis The documented installation procedures retrieve mutable scripts from an external server and immediately execute the returned content through Bash or PowerShell. Neither procedure pins a release version, verifies a cryptographic hash or signature, nor gives the user an opportunity to inspect the downloaded script before execution. Although the installer domain appears related to the declared OOMOL service and the installation is presented as a conditional first-time setup step, the reviewed Skill package does not control the code that the remote endpoint may return later. Trust established by reviewing `SKILL.md` therefore does not extend to the effective installation payload. The commands give the remote delivery infrastructure a direct code-execution channel on the host, exceeding the minimum privileges required merely to explain how to obtain the CLI safely. The Bash command uses `curl` to stream the HTTP response directly into `bash`. The PowerShell equivalent uses `Invoke-RestMethod` through the `irm` alias and executes the response with `Invoke-Expression` through `iex`. In both cases, any script supplied by the endpoint is interpreted with the permissions of the invoking user. ### Attack Path 1. The `oo` CLI is absent and an action fails with `oo: command not found`. 2. The user or agent follows the first-time setup instructions. 3. The host requests `install.sh` or `install.ps1` from the external OOMOL endpoint. 4. An attacker compromis ...[truncated 1295 chars]- Remediation
View remediation