T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:68
- Finding
- Unverified Remote Installation Scripts Executed Directly by Shells<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 68–72 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The installation instructions retrieve scripts from an external server and execute the responses immediately using `bash` or PowerShell's `Invoke-Expression`. They do not pin a release version, verify a cryptographic signature or checksum, or provide an opportunity to inspect the downloaded content before execution. Consequently, the effective installation payload can change after the Skill has been audited. HTTPS protects the connection in transit under normal conditions, but it does not protect against compromise of the hosting infrastructure, publication account, installation script, or trusted TLS/DNS environment. The installation behavior is not required for ordinary WorkOS actions because the Skill states that the CLI should already be installed and treats installation only as a fallback. Automatically executing an unrestricted remote script therefore exceeds the minimum privileges needed to submit WorkOS connector requests. No explicit approval requirement is specified before performing this security-sensitive installation. The Windows command has the same trust-boundary failure as the Unix command: `irm` retrieves mutable remote content, while `iex` interprets that content as PowerShell code in the current process. ### Attack Path 1. The `oo` CLI is unavailable, or an attacker causes the command lookup to fail. 2. The Agent follows the documented first-time setup fallback. 3. It requests `install.sh` or `install.ps1` from the external OOMOL server. 4. The response is passed directly to a command interpreter without integrity or authenticity verification. 5. If the re ...[truncated 1199 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove both direct download-to-interpreter pipelines. 2. Pin installation instructions to a specific, immutable CLI release rather than a mutable installation endpoint. 3. Download the installer or package to a local file without executing it: - Use a securely created temporary location. - Refuse redirects to unexpected domains. - Apply restrictive file permissions. 4. Verify a vendor-published SHA-256 or stronger digest before execution. Prefer a cryptographic signature whose public verification key is distributed through a separate trusted channel. 5. Display the source, version, destination, and requested privileges, then obtain explicit user approval before running any installer. 6. Execute the installer without administrative privileges unless elevation is demonstrably required and separately approved. 7. Prefer an official package manager or signed release artifact with version pinning and provenance verification. 8. Document manual installation as a user-controlled prerequisite rather than allowing the Agent to install software automatically. 9. Apply the same controls to the PowerShell installer; replacing `iex` with another immediate execution mechanism would not resolve the issue. 10. After installation, verify the installed binary's version, signature or checksum, ownership, and resolved executable path before invoking it. ]]>