T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:56
- Finding
- Unverified Remote Installer Download and Immediate Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 56–60 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The setup instructions pipe responses retrieved from external URLs directly into command interpreters. Neither installation path pins a release, verifies a cryptographic checksum or signature, saves the script for inspection, nor constrains the commands that the downloaded script may execute. HTTPS provides transport protection but does not establish the integrity or immutability of the effective payload after this Skill has been reviewed. Compromise of the remote server, domain, CDN, publishing credentials, or installer-generation process could cause arbitrary replacement code to be executed. Installing the required CLI is related to the Skill's setup, but immediate execution of mutable remote content is not the minimum privilege or safest mechanism necessary to install it. It also falls outside the declared `allowed-tools: [Bash(oo *)]` operational boundary because installation invokes `curl`, `bash`, or PowerShell rather than an already installed `oo` command. ### Attack Path 1. A Tongdaxin operation fails because the `oo` CLI is not installed. 2. The user or agent follows the documented first-time setup instructions. 3. `curl` or `Invoke-RestMethod` retrieves the current installer response from the external OOMOL endpoint. 4. The response is passed directly to Bash or PowerShell without inspection or integrity verification. 5. If the hosting or software-distribution channel has been compromised, attacker-controlled commands execute with the privileges of the invoking account. ### Impact Assessment A substituted installer can execute arbi ...[truncated 734 chars]
- Remediation
- ## Remediation Suggestions 1. Remove both direct execution pipelines (`curl | bash` and `irm | iex`). 2. Direct users to a versioned release from a documented official distribution repository. 3. Download the installer or binary to disk without executing it automatically. 4. Pin an explicit version and publish a cryptographic checksum or verifiable digital signature through an independent trusted channel. 5. Require verification of the checksum or signature before installation. 6. Allow the user to inspect the installer and explicitly approve execution. 7. Prefer signed, platform-native packages with constrained installation behavior. 8. Keep installation outside the Skill's normal `oo`-only tool scope and never trigger it automatically after a failed action. 9. Document the files, permissions, and network endpoints used by the installer so users can evaluate its privilege requirements.