T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:70
- Finding
- Unverified Remote Installation Scripts Executed Directly by Shells## Vulnerability Details **File Location**: `SKILL.md`, lines 70 and 74 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical The first-time setup instructions execute remotely retrieved installation scripts directly in Bash or PowerShell: ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis Both commands pass a network response directly to a command interpreter. The instructions do not pin an immutable script version, verify a hard-coded cryptographic digest, validate a publisher signature, save the script for inspection, or constrain the script's permissions. Consequently, the code executed on a user's system is not the code contained in the audited Skill and may change after the audit. Compromise of the hosting domain, DNS, CDN, TLS termination, publishing credentials, or deployment infrastructure could replace the installer with arbitrary commands. Installing the `oo` CLI is relevant to the declared Zixflow connector functionality, but immediate execution of mutable remote content exceeds the minimum mechanism necessary to perform that installation safely. The same weakness exists on both supported platform families. ### Attack Path 1. The `oo` command is unavailable and an authentication or connector operation fails. 2. The user or agent follows the first-time setup instructions in `SKILL.md`. 3. An attacker compromises or gains control over the content returned by `cli.oomol.com/install.sh` or `cli.oomol.com/install.ps1`. 4. `curl` or `Invoke-RestMethod` retrieves the attacker-controlled response. 5. The pipe to `bash` or invocation through `iex` executes the response immediately, without integrity verification or review. 6. The payload operates with the privileges and access available to the invoking process and may retrieve addi ...[truncated 986 chars]
- Remediation
- ## Remediation Suggestions 1. Remove all direct `curl | bash` and `Invoke-RestMethod | Invoke-Expression` installation instructions. 2. Prefer a trusted platform package manager or signed official package repository. 3. Pin the installer to a specific immutable release rather than a mutable generic installation URL. 4. Download the installer to a local file without executing it immediately. 5. Verify the downloaded artifact using a hard-coded SHA-256 digest and, where available, a publisher signature anchored to a documented trusted key. 6. Abort installation if any integrity or signature check fails. 7. Show the installer source and intended filesystem changes to the user before execution. 8. Require explicit user approval before running any installer. 9. Run the installer with ordinary user privileges unless a documented operation strictly requires elevation; isolate elevated steps and explain them individually. 10. Document the exact release version, expected digest, publisher identity, destination paths, and rollback procedure. A safer installation flow should follow this pattern: ```bash curl -fSLo oo-install.sh "https://trusted.example/oo/releases/vX.Y.Z/install.sh" echo "EXPECTED_SHA256 oo-install.sh" | sha256sum --check - less oo-install.sh bash oo-install.sh ``` The version and digest must be maintained by the publisher and replaced with validated release-specific values.