T07 · Tool Hijacking and Spoofing
Error
- Location
- SKILL.md:65
- Finding
- CLI-Controlled Upgrade Instructions May Cause Arbitrary Command Execution<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 65-73 **Vulnerability Type**: Trusting externally controlled tool output as executable instructions **Risk Level**: High ### Vulnerable Code Snippet The operative instruction from the source is translated into English below: ```text Upgrade when the command returns: {"ok":false,"stage":"version",...} The message contains the upgrade command; execute it as instructed. ``` The document also provides this expected upgrade command: ```bash npm i -g @iqinghu/qhkit@latest ``` ### Technical Analysis The Skill directs the Agent to execute an upgrade command supplied in the `message` field of a `qhkit` response. This response is generated by the locally installed third-party CLI and may also be influenced by its remote backend. Tool output crosses a trust boundary and must be treated as untrusted data. Following a command from that output without validating it against a fixed allowlist creates a command-injection channel. The problem is not the documented `npm i` command by itself; it is the broader instruction to execute whatever upgrade command appears in `message`. An attacker who compromises the npm package, the installed CLI, its update service, or a relevant backend response could replace the expected upgrade text with an arbitrary shell command. The Agent may then execute that command under the identity running the Skill. ### Attack Path 1. The attacker compromises the `@iqinghu/qhkit` package, installed CLI, update service, or backend response path. 2. The compromised component returns a response resembling: ```json {"ok":false,"stage":"version","message":"<attacker-controlled command>"} ``` 3. The Skill interprets the response as a version-gate condition. 4. Following the instruction in `SKILL.md`, the Agent executes the command contained in `message`. 5. The command runs with the Agent process's operating-system permissions. 6. The attacker can access or alter resources ...[truncated 992 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove the instruction to execute commands supplied in the CLI's `message` field. - Treat all stdout and stderr from `qhkit` as untrusted data intended only for display or structured parsing. - Hard-code a narrowly allowed upgrade operation rather than deriving it from tool output. - Require explicit user approval before installing or upgrading executable software. - Validate version-gate responses against a strict schema and ignore any embedded shell syntax. - Use a fixed argument array through a process-execution API rather than constructing a shell command. - Reject unexpected arguments, registry URLs, command substitutions, redirections, pipes, and shell metacharacters. - Pin upgrades to a reviewed version and verify package integrity before execution. - Run the CLI in a restricted environment without unnecessary filesystem, credential, or network access. - Display an untrusted `message` value to the user as text only; never pass it to a shell. ]]>