T07 · Tool Hijacking and Spoofing
Warning
- Location
- openclaw.plugin.json:9
- Finding
- Plugin Delegates Tool Execution to an Unpackaged Absolute Host Path<![CDATA[ ## Vulnerability Details **File Location**: `openclaw.plugin.json`, line 9 **Vulnerability Type**: T07: Tool Hijacking and Spoofing **Risk Level**: Medium ### Vulnerable Code ```json { "id": "doubao-launch", "name": "Doubao Launch", "version": "1.0.0", "description": "Launch Doubao desktop application and configure real-time translation window.", "tools": [ "launch_doubao" ], "entry": "/mnt/h/AI/openclaw_workspace/video_translate/skills/doubao_auto_workflow.py" } ``` ### Technical Analysis The plugin registers `launch_doubao` but delegates its execution to the absolute path `/mnt/h/AI/openclaw_workspace/video_translate/skills/doubao_auto_workflow.py`. That executable is outside the audited project and is not included among the supplied files. Consequently, the package does not bind the registered tool to a reviewed implementation. The effective behavior depends on whichever file occupies the external path at invocation time. A user or process with write access to that host-mounted workspace could replace or modify the Python file without changing the reviewed plugin package. The documentation is also inconsistent with the configuration: `SKILL.md` refers to the package-relative path `scripts/doubao_auto_workflow.py`, but no such file is present. In addition, `package.json` declares `index.js` as its main file, although that file is also absent. These omissions prevent verification of the tool's actual runtime behavior. ### Attack Path 1. An attacker obtains write access to `/mnt/h/AI/openclaw_workspace/video_translate/skills/` or the referenced `doubao_auto_workflow.py` file. 2. The attacker creates or replaces `doubao_auto_workflow.py` with attacker-controlled Python code. 3. The plugin remains apparently unchanged and continues to expose the legitimate-looking `launch_doubao` tool. 4. An Agent or user invokes `launch_doubao`. 5. The plugin resolves the absolute entry path and executes the substituted implementation. 6. The a ...[truncated 977 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Include the complete `doubao_auto_workflow.py` implementation within the distributed and reviewed project. 2. Replace the absolute host path with a package-relative entry point, such as `scripts/doubao_auto_workflow.py`. 3. Ensure the package manifest includes every executable file required at runtime and remove or correct the nonexistent `index.js` declaration. 4. Make the runtime implementation read-only to untrusted users and processes. 5. If external execution is unavoidable, verify the executable against a pinned cryptographic hash or trusted signature before every invocation. 6. Reject symbolic links and validate the canonical path so path substitution cannot redirect execution outside an approved directory. 7. Run the tool under a least-privileged account with restricted filesystem, network, process-launch, and host-mount access. 8. Align `SKILL.md`, `openclaw.plugin.json`, and `package.json` so that documentation and manifests reference the same bundled implementation. ]]>