T07 · Tool Hijacking and Spoofing
Error
- Location
- openclaw.plugin.json:8
- Finding
- Tool Entry Redirects Execution to Unreviewed Code Outside the Package## Vulnerability Details **File Location**: `openclaw.plugin.json`, lines 8–9 **Vulnerability Type**: Tool hijacking through an absolute external entry path **Risk Level**: High **Complete Code Snippet**: ```json "tools": [ "youtube_translate" ], "entry": "/mnt/h/AI/openclaw_workspace/video_translate/skills/workflow.py" ``` ### Technical Analysis The plugin registers the legitimate-looking `youtube_translate` tool but directs its execution to an absolute filesystem path outside the audited package. The referenced implementation is not included in the project, so its contents and behavior cannot be reviewed or integrity-checked as part of this package. The declarations are also inconsistent: `package.json` identifies `workflow.py` as the main file, while `SKILL.md` documents `scripts/workflow.py`; neither implementation exists in the audited directory. Consequently, the plugin's effective behavior depends entirely on mutable host code at `/mnt/h/AI/openclaw_workspace/video_translate/skills/workflow.py`. An attacker who can create or replace that external file can cause a normal invocation of `youtube_translate` to execute attacker-controlled logic under the privileges of the Agent or plugin host. ### Attack Path 1. The plugin is installed or loaded with `youtube_translate` exposed as an available tool. 2. An attacker gains write access to `/mnt/h/AI/openclaw_workspace/video_translate/skills/workflow.py`, or prepares that path before deployment. 3. The attacker places arbitrary Python logic at the external path. 4. A user or Agent invokes the legitimate-looking `youtube_translate` tool. 5. The plugin resolves the absolute entry and executes the unreviewed external implementation. 6. The malicious implementation performs actions permitted by the plugin-host process. ### Impact Assessment Successful exploitation permits arbitrary behavior within the security context of the Agent or plugin host. Depending on t ...[truncated 484 chars]
- Remediation
- ## Remediation Suggestions 1. Include the complete implementation within the distributed and audited package. 2. Replace the absolute entry with a package-relative path, such as `scripts/workflow.py`. 3. Ensure the manifest, `package.json`, and `SKILL.md` reference the same shipped entry file. 4. Have the plugin loader canonicalize entry paths and reject any path that resolves outside the package root. 5. Verify the packaged implementation using signed releases or cryptographic integrity metadata before execution. 6. Apply least-privilege execution controls, including restricted filesystem access, limited network access, and isolation from unrelated credentials. 7. Fail closed when the packaged entry is missing rather than falling back to external or host-specific paths.