T07 · Tool Hijacking and Spoofing
Warning
- Location
- scripts/generate-nano-art.sh:48
- Finding
- Execution of an Unverified Script Outside the Skill Trust Boundary## Vulnerability Details **File Location**: `scripts/generate-nano-art.sh`, lines 48-54 **Vulnerability Type**: External local tool hijacking **Risk Level**: Medium ### Vulnerable Code ```bash # Call Core Primitive SCRIPT_DIR="$( cd "$( dirname "${BASH_SOURCE[0]}" )" && pwd )" CORE_SCRIPT="$SCRIPT_DIR/../../../../core/media/generate-image.sh" bash "$CORE_SCRIPT" --prompt "$EXPERT_PROMPT" --model "nano-banana-pro" --resolution "$RESOLUTION" $VIEW_FLAG --json ``` ### Technical Analysis The Skill delegates its core operation to `generate-image.sh`, located four directory levels above the Skill's `scripts` directory. This executable is outside the supplied project and therefore outside the audited Skill trust boundary. Its implementation, ownership, integrity, and security properties cannot be verified from the reviewed files. Although the computed path is not directly controlled through command-line parameters, the script performs no canonical-path validation, file ownership check, permission check, or cryptographic integrity verification before executing the external file with Bash. An actor who can create or replace the file at the resolved location can substitute arbitrary shell logic behind an apparently legitimate image-generation operation. No direct shell-command injection was identified in the handling of `SUBJECT`, `ACTION`, `CONTEXT`, `STYLE`, `LIGHTING`, `RESOLUTION`, or `TEXT`; those values are incorporated into a quoted prompt argument. The security issue instead arises from trusting and executing an unaudited external tool. ### Attack Path 1. An attacker obtains write access to the expected external script path or one of its parent directories. 2. The attacker creates or replaces `core/media/generate-image.sh` with a malicious shell script. 3. A user or Agent invokes `scripts/generate-nano-art.sh` for a normal image-generation request. 4. The Skill resolves the external path and executes the subst ...[truncated 821 chars]
- Remediation
- ## Remediation Suggestions 1. Package the required image-generation implementation within the reviewed Skill or invoke a platform-managed API with an explicit trust contract. 2. Avoid traversing outside the Skill root to locate executables. Resolve the dependency through a fixed, administrator-controlled path or trusted runtime configuration. 3. Canonicalize the target path with `realpath` and verify that it remains inside an approved trust root before execution. 4. Verify that the target is a regular file, is owned by an approved account, and is not writable by untrusted users or groups. 5. Pin and validate the executable using a cryptographic digest or signed release mechanism before invoking it. 6. Execute the generator under a least-privileged account or sandbox with restricted filesystem, environment, and network access. 7. Fail closed with a clear error if the target is missing, has unexpected ownership or permissions, fails integrity validation, or resolves outside the approved directory. 8. Document the external dependency and include its implementation in future audits so its network behavior, credential handling, and data transmission can be assessed.