T07 · Tool Hijacking and Spoofing
Error
- Location
- _meta.json:6
- Finding
- Execution of Unbundled Scripts from a Mutable External Workspace## Vulnerability Details **File Location**: `_meta.json`, lines 6-9 **Vulnerability Type**: Local tool hijacking through external script references **Risk Level**: High ```json "scripts": { "recent": "python3 /root/.openclaw/workspace/scripts/jin10_push.py recent", "detail": "python3 /root/.openclaw/workspace/scripts/jin10_push.py detail", "deep": "python3 /root/.openclaw/workspace/scripts/jin10_push.py deep" } ``` ### Technical Analysis The Skill delegates all declared operations to Python scripts located outside the reviewed package. Neither `jin10_push.py` nor the separately documented `jin10_fetcher.py` is included in the project, which contains only `SKILL.md` and `_meta.json`. Because the referenced scripts reside in a shared, absolute workspace path, the code executed at runtime can differ from the code reviewed during publication. Any process or user capable of writing to that location could replace or modify the scripts without changing the Skill package or its metadata. The resulting Python process would then execute the substituted code with the permissions and environment of the Agent. This design also prevents verification of the documented network requests, local cache handling, financial analysis, and `x-token` processing. In particular, it is not possible to establish whether the token is restricted to an approved HTTPS Jin10 endpoint, omitted from logs, or excluded from cache files. No explicit malicious endpoint or confirmed token exfiltration is present in the reviewed files; the risk arises from handing execution and secret handling to unaudited external code. ### Attack Path 1. An attacker obtains write access to `/root/.openclaw/workspace/scripts/`, or otherwise causes a malicious file to be placed at the expected path. 2. The attacker replaces or creates `jin10_push.py` while preserving the expected command-line interface. 3. A user or Agent invokes the `recent`, `detail`, or `deep` action. ...[truncated 1344 chars]
- Remediation
- ## Remediation Suggestions 1. Include every executable Python module in the Skill package so the reviewed artifact contains the complete runtime implementation. 2. Resolve script paths relative to the installed Skill directory rather than using shared absolute workspace paths. 3. Make installed Skill files read-only to unprivileged users and restrict directory ownership and write permissions. 4. Verify packaged scripts with signed releases or cryptographic hashes before execution. 5. Declare and pin third-party dependencies in a lock file, including exact versions and trusted package sources. 6. Run the scripts as a dedicated, non-root service account with access only to the required cache directory and approved network destinations. 7. Store the Jin10 token in protected secret storage. Do not place it in source files, command-line arguments, logs, or cache data. 8. Restrict token transmission to explicitly documented Jin10 HTTPS hosts, validate TLS certificates, and reject redirects to unapproved domains. 9. Use a private cache directory with restrictive permissions instead of a predictable shared `/tmp` location, or securely create and validate cache files to prevent symlink and replacement attacks. 10. Add automated tests that verify network destinations, secret redaction, cache permissions, and the integrity of invoked scripts.