T07 · Tool Hijacking and Spoofing
Error
- Location
- openclaw.plugin.json:9
- Finding
- External Executable Entry Allows Tool Implementation Replacement## Vulnerability Details **File Location**: `openclaw.plugin.json`, line 9 **Vulnerability Type**: Tool hijacking through an external absolute entry path **Risk Level**: High ### Vulnerable Code ```json "entry": "/mnt/h/AI/openclaw_workspace/video_translate/skills/download_audio.py" ``` ### Technical Analysis The plugin delegates execution of the `download_audio` tool to an absolute filesystem path outside the audited package. The referenced Python file is absent from the supplied artifact, so its integrity and behavior cannot be established through review of this package. This creates a trust-boundary failure: the reviewed plugin configuration can remain unchanged while the effective implementation is replaced by modifying the external file. The path also conflicts with the package-relative command documented at `SKILL.md:10`: ```bash python scripts/download_audio.py <URL> [--cookies cookies.txt] [--output-dir dir] ``` Consequently, the package is not self-contained, and the runtime implementation may differ from the documented and reviewed behavior. The handling of cookie files, command arguments, network destinations, downloaded data, and filesystem side effects cannot be verified. ### Attack Path 1. An attacker obtains write access to the external file or one of its parent directories at `/mnt/h/AI/openclaw_workspace/video_translate/skills/`. 2. The attacker creates or replaces `download_audio.py` with attacker-controlled Python code. 3. The package configuration continues to advertise the legitimate-looking `download_audio` tool. 4. A user or Agent invokes that tool. 5. OpenClaw resolves the absolute entry and executes the substituted implementation. 6. The attacker-controlled code runs with the filesystem, network, and process privileges available to the plugin host. ### Impact Assessment Successful exploitation permits arbitrary behavior within the privileges of the process executing the plugi ...[truncated 624 chars]
- Remediation
- ## Remediation Suggestions 1. Include the complete `download_audio.py` implementation in the distributed package, preferably under a package-owned directory such as `scripts/`. 2. Replace the absolute entry with a package-relative path, for example: ```json "entry": "scripts/download_audio.py" ``` 3. Resolve and canonicalize the configured entry at load time, then reject it unless the resolved path remains inside the package root. 4. Reject symbolic-link or junction traversal that could redirect a package-relative entry outside the package. 5. Ensure the manifest and `SKILL.md` reference the same implementation path. 6. Include the executable implementation in code review, release artifacts, and integrity checks. Where supported, verify signed packages or cryptographic hashes before execution. 7. Apply least privilege to the plugin runtime and restrict access to cookie files, unrelated filesystem locations, subprocess execution, and unnecessary network destinations. 8. Add packaging tests that fail when a declared entry is absent, external to the package, or inconsistent with the documented command.