T07 · Tool Hijacking and Spoofing
Error
- Location
agents/scanner/agent.cjs:8- Finding
Execution of Unverified Shell Scripts Outside the Audited Skill Package
- Content
View full analysis
exec('~/aass-dataset/secure_dataset.sh scan 2>&1',{timeout:180000},(ex,out)=>ex?e(ex):r(out))); log('扫描完成'); ``` ```javascript // agents/analyzer/agent.cjs:9 await new Promise((r,e)=>exec('~/aass-scripts/3layer_scheduler.sh analyzer 2>&1',{timeout:300000},(ex,out)=>ex?e(ex):r(out))); ``` ```javascript // agents/researcher/agent.cjs:9 await new Promise((r,e)=>exec('~/aass-scripts/daily_intel.sh 2>&1',{timeout:600000},(ex,out)=>ex?e(ex):r(out))); ``` ### Technical Analysis The scanner, analyzer, and researcher agents execute shell scripts stored outside the audited project. These scripts are not included in the Skill, and the reviewed code does not validate their ownership, permissions, integrity, or expected contents before execution. The documented manager starts all three affected agent types. Consequently, invoking the normal start operation can execute code whose effective behavior is not represented by the reviewed package. The use of `child_process.exec` additionally invokes a shell, expanding the execution surface beyond what is required to launch a fixed local program. This is a local tool-hijacking risk: an attacker or compromised process capable of creating or replacing one of the referenced scripts can cause attacker-controlled commands to run under the identity of the user operating the Skill. No privilege escalation beyond that user's existing permissions is demonstrated. ### Attack Path 1. An attacker obtains write access to the current user's `~/aass-dataset` or `~/aass-scripts` directory, or creates the expected path before the legitimate component is installed. 2. The attacker pl ...[truncated 1029 chars]- Remediation
View remediation