T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:63
- Finding
- Unverified Remote Installer Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 63-67 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical **Vulnerable Code**: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable content from external URLs and immediately execute it through `bash` or PowerShell's `Invoke-Expression`. The payload is not pinned to a specific release, downloaded for inspection, or verified using a cryptographic signature or pinned checksum. Consequently, the code ultimately executed can change after the Skill has been reviewed. Trust is placed in the remote domain, its hosting infrastructure, DNS and TLS delivery path, and the continued security of the installer publication process. A compromise at any of these points could replace the legitimate installer with arbitrary commands. Installation is presented only as a fallback when the `oo` command is unavailable, and the Skill's declared tool restriction is `Bash(oo *)`. If that restriction is correctly enforced, the agent cannot directly invoke the displayed `curl` command. Nevertheless, the instructions may induce a user or a less strictly constrained runtime to execute the pipelines manually. Direct pipe-to-shell execution exceeds the minimum safe installation mechanism for the declared Torii query functionality. The separately flagged network behavior associated with `oo connector run` is consistent with the Skill's declared purpose of querying Torii through OOMOL. The reviewed file contains no evidence that raw credentials or returned Torii records are deliberately transmitted to an unrelated destination. ### Attack Path 1. An attacker compromises the installer publication account, `cli.oomol.com`, its hosting infrastructure, or another trusted d ...[truncated 1386 chars]
- Remediation
- ## Remediation Suggestions - Remove the `curl | bash` and `irm | iex` pipelines from the setup instructions. - Prefer an authenticated platform package manager or a version-pinned release artifact from the official project repository. - Separate download and execution into distinct steps so users can inspect the installer before running it. - Publish cryptographic signatures or SHA-256 checksums through an independently protected channel and require verification before execution. - Pin installation instructions to an explicit CLI version rather than a mutable generic installer URL. - Avoid requesting administrator privileges unless a documented installation step strictly requires them. - Keep installation outside automated Skill execution and require explicit user approval before running any installer. - If scripts must be used, document a safer process such as downloading to a non-executable temporary file, verifying its signature and expected owner, reviewing it, and then executing it with least privilege. - Preserve and enforce the existing `Bash(oo *)` tool restriction so the Skill cannot directly run downloaders, shells, or unrelated commands.