T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:42
- Finding
- Unverified Mutable Remote Installer Executed Directly by Shell## Vulnerability Details **File Location**: `SKILL.md`, line 42 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete Code Snippet**: ```bash sh -c "$(curl -fsSL https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/master/tools/install.sh)" "" --unattended ``` ### Technical Analysis The installation instruction downloads a shell script from the mutable `master` branch of the Oh My Zsh repository and immediately executes its contents with `sh`. It does not pin the payload to a reviewed commit or release and performs no checksum or signature verification. Consequently, the code executed at installation time may differ from the code assessed during this audit. Although the URL points to the official Oh My Zsh GitHub organization and installing Oh My Zsh is consistent with the Skill's terminal-customization purpose, direct execution of mutable remote content is not the minimum-risk mechanism necessary to provide that functionality. The `--unattended` option also suppresses interactive installation prompts, reducing the user's opportunity to inspect or reject unexpected actions. ### Attack Path 1. An attacker compromises the upstream repository, a maintainer account, or another component capable of altering the script served from the referenced mutable branch. 2. The attacker adds malicious shell commands to the remote installer. 3. A user or agent follows the Skill and runs the documented installation command. 4. `curl` retrieves the current attacker-controlled script without integrity verification. 5. Command substitution passes the downloaded content directly to `sh`. 6. The malicious commands execute with the permissions of the user running the Skill. ### Impact Assessment A substituted installer could obtain arbitrary user-level code execution. It could read or modify files accessible to the invoking account, alter shell configuration and startup files, access environment varia ...[truncated 399 chars]
- Remediation
- ## Remediation Suggestions 1. Pin the installer to a specific, reviewed commit rather than the mutable `master` branch. 2. Download the installer to a local file instead of piping or substituting it directly into a shell. 3. Verify its SHA-256 checksum against an independently trusted expected value or validate a cryptographic signature. 4. Allow the user to inspect the downloaded script before execution. 5. Avoid unattended execution unless automation is explicitly required and all resulting file changes are documented. 6. Prefer a trusted package-manager package or another installation method with version pinning and integrity controls where available. 7. Run the installer as an ordinary user and do not add `sudo` or other privilege-escalation mechanisms. A safer pattern is: ```bash curl -fL \ -o /tmp/ohmyzsh-install.sh \ "https://raw.githubusercontent.com/ohmyzsh/ohmyzsh/<PINNED_COMMIT>/tools/install.sh" echo "<EXPECTED_SHA256> /tmp/ohmyzsh-install.sh" | shasum -a 256 -c - less /tmp/ohmyzsh-install.sh sh /tmp/ohmyzsh-install.sh --unattended rm -f /tmp/ohmyzsh-install.sh ``` The pinned commit and expected digest must be supplied from trusted, reviewed sources.