T07 · Tool Hijacking and Spoofing
Error
- Location
- openclaw.plugin.json:9
- Finding
- Tool Entry References an Unbundled External Executable## Vulnerability Details **File Location**: `openclaw.plugin.json:9` **Vulnerability Type**: External tool hijacking through an absolute, package-external entry path **Risk Level**: High ### Vulnerable Code ```json { "id": "audio-play", "name": "Audio Play", "version": "1.0.0", "description": "Play audio files using Windows media player. Non-blocking execution.", "tools": [ "play_audio" ], "entry": "/mnt/h/AI/openclaw_workspace/video_translate/skills/audio_play.py" } ``` ### Technical Analysis The plugin registers `play_audio` but delegates its implementation to an absolute host-specific path outside the audited package. The referenced Python file is not included in the artifact, so its content and integrity cannot be verified as part of this review. This creates a trust-boundary failure: the legitimate plugin manifest can remain unchanged while the external file is replaced or modified. If the OpenClaw runtime loads this entry without independent integrity verification, a party with write access to the referenced path can substitute arbitrary Python logic that is then presented to users and agents as the trusted `play_audio` tool. The documentation also refers to `scripts/audio_play.py`, but that file is absent and does not match the manifest entry. This reinforces that the distributed artifact is incomplete and that its effective executable behavior resides outside the reviewed package. ### Attack Path 1. An attacker obtains write access to `/mnt/h/AI/openclaw_workspace/video_translate/skills/audio_play.py` or controls how that mounted path is resolved. 2. The attacker replaces or modifies the referenced file with malicious Python code. 3. The plugin is loaded using the unchanged `openclaw.plugin.json` manifest. 4. A user or agent invokes the apparently legitimate `play_audio` tool. 5. The runtime executes the substituted external implementation under the privileges of the OpenClaw process. 6. The malicious implementation can perform ...[truncated 794 chars]
- Remediation
- ## Remediation Suggestions 1. Bundle the Python implementation inside the skill package and reference it through a package-relative path. 2. Ensure the packaged implementation is included in code review, release signing, and integrity verification. 3. Reject absolute entry paths and paths that resolve outside the package root. 4. If external execution is unavoidable, pin and verify the target file with a cryptographic digest or trusted signature before loading it. 5. Restrict write permissions on executable plugin files to trusted administrators or the deployment service account. 6. Make the documentation and manifest reference the same bundled implementation. 7. Add installation-time validation that fails closed when the declared entry is missing, external, writable by untrusted users, or inconsistent with the package contents. 8. Remove or correct the absent `index.js` declaration in `package.json` to prevent ambiguous or incomplete package loading behavior.