T03 · Remote Payload Retrieval and Execution
Error
- Location
- references/tools-guide.md:131
- Finding
- Unverified Remote PowerShell Installers Are Downloaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `references/tools-guide.md`, lines 131–134 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High ### Vulnerable Code ```powershell # Claude Code irm https://claude.ai/install.ps1 | iex # Kimi CLI irm https://code.kimi.com/install.ps1 | iex ``` ### Technical Analysis The documented installation procedure uses PowerShell's `Invoke-RestMethod` alias (`irm`) to retrieve mutable scripts from external URLs and pipes their contents directly into `Invoke-Expression` (`iex`). This causes remotely supplied PowerShell code to execute immediately in the current user's security context. No version pinning, cryptographic checksum validation, publisher-signature verification, local inspection, or execution sandbox is required. Consequently, the effective code executed by this Skill can change after the Skill package has been audited. Trust in the downloaded payload depends entirely on the external servers, their upstream deployment systems, DNS resolution, and the host's TLS trust chain. This behavior is not required for the Skill's core multi-agent workflow. Safer installation processes can obtain the same tools without directly executing unverified network content. ### Attack Path 1. An attacker compromises an installer endpoint, its publishing pipeline, or another component in the delivery chain. 2. The attacker replaces the expected installer with malicious PowerShell content. 3. A user follows the documented setup instructions. 4. `irm` retrieves the modified response. 5. The pipeline passes the response directly to `iex` without review or verification. 6. The malicious payload executes with all permissions available to the PowerShell process. 7. The payload can access user data, alter files, steal credentials available to the process, install persistence, or download further components. ### Impact Assessment Successful exploitation provides arbitrary code execution with the pri ...[truncated 539 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove all `irm ... | iex` installation instructions. 2. Direct users to a version-pinned release or installer from an authenticated vendor release page. 3. Download the installer to a local file without executing it: ```powershell Invoke-WebRequest -Uri "<version-pinned URL>" -OutFile "./installer.ps1" ``` 4. Publish and require verification of a trusted SHA-256 checksum: ```powershell Get-FileHash "./installer.ps1" -Algorithm SHA256 ``` 5. Where applicable, require validation of the vendor's Authenticode signature: ```powershell Get-AuthenticodeSignature "./installer.ps1" ``` 6. Tell users to inspect the downloaded script before execution. 7. Run installation with the least-privileged account possible and only request elevation if a documented installation step requires it. 8. Prefer signed package-manager distributions with pinned package names and versions. ]]>