T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:74
- Finding
- Unverified Remote Installer Is Piped Directly into a Shell## Vulnerability Details **File Location**: `SKILL.md`, line 74 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: High **Complete Code Snippet**: ```bash curl -fsSL https://ollama.com/install.sh | sh ``` ### Technical Analysis The installation instructions download a mutable remote script and execute it immediately through `sh`. The command provides no version pinning, cryptographic checksum verification, publisher-signature validation, or opportunity to inspect the downloaded content before execution. As a result, the effective payload is not contained in the audited Skill and can change after the package has been reviewed. Trust is delegated entirely to the remote domain, its hosting infrastructure, DNS resolution, certificate trust chain, and upstream release process. Ollama is presented as an optional local LLM provider, so direct remote-script execution is not necessary for the Skill's declared data-processing functionality. A verified package-manager installation or a separately downloaded, version-pinned, authenticated artifact would provide the optional dependency without exposing an unrestricted remote code-execution channel. ### Attack Path 1. A user follows the installation instructions in `SKILL.md`. 2. `curl` retrieves the current response from `https://ollama.com/install.sh`. 3. The response is passed directly to `sh` without local inspection or integrity verification. 4. If the remote origin, distribution infrastructure, DNS/TLS trust path, or installer content is compromised, attacker-controlled shell commands execute locally. 5. Those commands operate with the privileges of the user running the command and can invoke privilege-elevation mechanisms if the user authorizes them. ### Impact Assessment A malicious or compromised installer can execute arbitrary commands with the invoking user's privileges. This may permit access to or modification of user-readable files, theft ...[truncated 613 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the `curl | sh` installation command from the Skill documentation. 2. Prefer an official, authenticated operating-system package manager and pin the expected package version where supported. 3. If a standalone installer is required: - Download it to a local file without executing it. - Pin an immutable release URL and explicit version. - Obtain the expected SHA-256 digest through a separately authenticated channel. - Verify the digest and the publisher's cryptographic signature. - Inspect the script before execution. - Run it as an unprivileged user unless a documented installation step strictly requires elevation. 4. Document the exact filesystem and system changes performed by the installer. 5. Treat Ollama as an optional external prerequisite rather than automatically installing it as part of the Skill workflow. 6. For stronger supply-chain controls, distribute a reproducible, signed package and verify its provenance or attestation before installation.