T03 · Remote Payload Retrieval and Execution
Note
- Location
- SKILL.md:58
- Finding
- Unverified Remote Installer Retrieval and Immediate Execution## Vulnerability Details **File Location**: `SKILL.md`, lines 58–64 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Malicious ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve mutable scripts from an external server and immediately pass them to `bash` or PowerShell's `Invoke-Expression`. The downloaded content is not pinned to an immutable release, saved for inspection, or verified using a cryptographic checksum or signature. Consequently, the code that ultimately executes can differ from what was available when the Skill was audited. Although the URLs use HTTPS and belong to the provider named by the Skill, HTTPS alone does not establish the integrity of a mutable installer. Compromise of the domain, hosting infrastructure, distribution pipeline, TLS termination, or installer publication account could replace the expected installer with arbitrary code. Installation is presented as a fallback for when the `oo` command is unavailable, rather than an operation performed on every invocation. This reduces exposure frequency but does not mitigate the arbitrary-code-execution risk. It also exceeds the Skill's normal `Bash(oo *)` least-privilege boundary because the installer itself can execute unrestricted shell operations. ### Attack Path 1. The Agent attempts to perform a Wiza operation and discovers that the `oo` CLI is unavailable. 2. It follows the documented first-time setup instructions. 3. `curl` or `Invoke-RestMethod` retrieves the current installer from the remote OOMOL endpoint. 4. The response body is passed directly to `bash` or `Invoke-Expression` without local integrity verification. 5. If the remote endpoint or software-distribution chain has been compromised, attacker-c ...[truncated 983 chars]
- Remediation
- ## Remediation Suggestions 1. Remove direct `curl | bash` and `irm | iex` execution patterns. 2. Prefer a trusted platform package manager with a pinned package version and authenticated repository metadata. 3. If a standalone installer is required: - Pin an immutable, versioned release URL. - Download the installer to a local file without executing it. - Publish an expected SHA-256 or stronger checksum through an independent trusted channel. - Verify the checksum before execution. - Prefer a signed artifact and validate its signature against a documented publisher key. - Allow the user to inspect the downloaded script before running it. 4. Require explicit user approval before installing software or executing any downloaded script. 5. Run installation with the lowest privileges possible and avoid requesting administrator access unless a specific installation step requires it. 6. Document the exact files, directories, network endpoints, and privileges used by the installer. 7. Keep normal Skill operation restricted to the declared `oo` command boundary after verified installation.