T03 · Remote Payload Retrieval and Execution
Error
- Location
- SKILL.md:82
- Finding
- Unverified Remote Installation Scripts Are Executed Directly## Vulnerability Details **File Location**: `SKILL.md`, lines 82–86 **Vulnerability Type**: Remote payload retrieval and execution **Risk Level**: Critical ### Vulnerable Code ```bash curl -fsSL https://cli.oomol.com/install.sh | bash # macOS / Linux ``` ```powershell irm https://cli.oomol.com/install.ps1 | iex # Windows PowerShell ``` ### Technical Analysis The first-time setup instructions download mutable scripts from an external server and immediately execute them using Bash or PowerShell. Neither installation path pins a release, verifies a cryptographic signature or checksum, nor allows inspection before execution. The HTTPS endpoint belongs to the stated CLI vendor, but HTTPS alone does not establish the integrity of the script over its lifetime. Compromise of the hosting infrastructure, release pipeline, domain, or TLS trust chain could change the effective payload after this Skill has been reviewed. Installation is presented as conditional on an `oo: command not found` error, which limits when the behavior occurs. Nevertheless, directly executing arbitrary remote content grants the installation source the full permissions of the user running the Agent. This exceeds the minimum privilege required to document how to install the CLI or operate the Trello connector. ### Attack Path 1. The Agent attempts a documented `oo` command and receives an `oo: command not found` error. 2. Following the fallback instructions, it executes the Bash or PowerShell installation command. 3. The command retrieves the current script from the remote OOMOL endpoint. 4. The shell executes the response without validating its version, checksum, signature, or contents. 5. If the endpoint or its delivery chain has been compromised, attacker-controlled commands execute with the invoking user's privileges. 6. Those commands can access data available to that user, modify local files, steal credentials, install additional payloads, or establish persistence. ### Im ...[truncated 864 chars]
- Remediation
- ## Remediation Suggestions 1. Remove both pipe-to-shell patterns: - Do not pipe `curl` output directly to `bash`. - Do not pass downloaded PowerShell content directly to `Invoke-Expression`. 2. Prefer a trusted package manager or signed release mechanism that supports pinned versions and package-integrity validation. 3. If script-based installation remains necessary: - Pin a specific immutable release URL rather than a mutable generic installer. - Download the installer to a local file without executing it. - Publish an expected SHA-256 digest through a separately protected channel. - Verify the digest before execution. - Cryptographically sign the installer and verify the signature against a documented vendor key. - Permit inspection of the downloaded file before it runs. - Abort installation on any verification failure. 4. Run installation with the least-privileged account possible. Do not request administrative privileges unless a documented installation operation strictly requires them. 5. Keep installation outside the Agent's automatic action path. On a missing CLI error, provide verified manual installation instructions rather than automatically executing remote content. 6. Pin and document the supported CLI version so the reviewed dependency cannot silently change after approval.