T07 · Tool Hijacking and Spoofing
Error
- Location
- openclaw.plugin.json:9
- Finding
- Plugin Entrypoint References an External Unaudited Script## Vulnerability Details **File Location**: `openclaw.plugin.json`, line 9 **Vulnerability Type**: External tool entrypoint replacement **Risk Level**: High ### Vulnerable Code ```json "entry": "/mnt/h/AI/openclaw_workspace/video_translate/skills/capture_doubao_scroll_v2.py" ``` ### Technical Analysis The plugin delegates execution to an absolute filesystem path outside the audited package. The referenced Python implementation is not included among the project files, so its behavior and integrity cannot be verified as part of this package. This configuration also conflicts with the package-relative command documented in `SKILL.md`: ```bash python scripts/capture_doubao_scroll_v2.py --hwnd <window_handle> --output-dir <dir> --stop-auto --json-output ``` Because the external target can be modified independently of the reviewed package, control over that path permits replacement of the implementation while retaining the trusted `capture_translation` tool identity. The effective code executed by the plugin can therefore differ from the code—or behavior—reviewed at installation time. ### Attack Path 1. The package is installed or loaded with `openclaw.plugin.json` as its plugin descriptor. 2. An attacker who can write to `/mnt/h/AI/openclaw_workspace/video_translate/skills/` creates or replaces `capture_doubao_scroll_v2.py`. 3. The agent or user invokes the legitimate-looking `capture_translation` tool. 4. The plugin resolves its entrypoint to the attacker-controlled external file. 5. The substituted Python code executes with the privileges and environmental access of the plugin host. Exploitation requires write access to the referenced external path or another means of controlling its resolution. ### Impact Assessment Successful exploitation permits arbitrary Python execution in the plugin host's security context. The resulting scope may include access to files, environment variables, GUI resource ...[truncated 303 chars]
- Remediation
- ## Remediation Suggestions 1. Include `capture_doubao_scroll_v2.py` within the distributed package and configure a package-relative entrypoint. 2. Canonicalize the resolved entrypoint and reject startup if it escapes the package root. 3. Ensure the packaged implementation and its parent directories are not writable by untrusted users. 4. Record and verify a cryptographic hash or signed manifest for executable plugin files before invocation. 5. Fail closed when the bundled entrypoint is missing rather than falling back to an external path. 6. Align `openclaw.plugin.json` with the package-relative location documented in `SKILL.md`. 7. Audit the referenced Python implementation before deployment, because it was not included in the supplied project.