T07 · Tool Hijacking and Spoofing
- Location
openclaw.plugin.json:8- Finding
Tool Entry Redirects Execution to Unreviewed Code Outside the Package
- Content
View full analysis
Vulnerability Details
File Location:
openclaw.plugin.json, lines 8–9
Vulnerability Type: Tool hijacking through an absolute external entry path
Risk Level: HighComplete Code Snippet:
json "tools": [ "youtube_translate" ], "entry": "/mnt/h/AI/openclaw_workspace/video_translate/skills/workflow.py"Technical Analysis
The plugin registers the legitimate-looking
youtube_translatetool but directs its execution to an absolute filesystem path outside the audited package. The referenced implementation is not included in the project, so its contents and behavior cannot be reviewed or integrity-checked as part of this package.The declarations are also inconsistent:
package.jsonidentifiesworkflow.pyas the main file, whileSKILL.mddocumentsscripts/workflow.py; neither implementation exists in the audited directory. Consequently, the plugin's effective behavior depends entirely on mutable host code at/mnt/h/AI/openclaw_workspace/video_translate/skills/workflow.py.An attacker who can create or replace that external file can cause a normal invocation of
youtube_translateto execute attacker-controlled logic under the privileges of the Agent or plugin host.Attack Path
- The plugin is installed or loaded with
youtube_translateexposed as an available tool. - An attacker gains write access to
/mnt/h/AI/openclaw_workspace/video_translate/skills/workflow.py, or prepares that path before deployment. - The attacker places arbitrary Python logic at the external path.
- A user or Agent invokes the legitimate-looking
youtube_translatetool. - The plugin resolves the absolute entry and executes the unreviewed external implementation.
- The malicious implementation performs actions permitted by the plugin-host process.
Impact Assessment
Successful exploitation permits arbitrary behavior within the security context of the Agent or plugin host. Depending on t ...[truncated 484 chars]
- The plugin is installed or loaded with
- Remediation
View remediation
Remediation Suggestions
- Include the complete implementation within the distributed and audited package.
- Replace the absolute entry with a package-relative path, such as
scripts/workflow.py. - Ensure the manifest,
package.json, andSKILL.mdreference the same shipped entry file. - Have the plugin loader canonicalize entry paths and reject any path that resolves outside the package root.
- Verify the packaged implementation using signed releases or cryptographic integrity metadata before execution.
- Apply least-privilege execution controls, including restricted filesystem access, limited network access, and isolation from unrelated credentials.
- Fail closed when the packaged entry is missing rather than falling back to external or host-specific paths.