T07 · Tool Hijacking and Spoofing
Error
- Location
- scripts/opencli.sh:4
- Finding
- Execution and Instruction Delegation to Unverified External Files## Vulnerability Details **File Location**: `scripts/opencli.sh:4` **Additional Locations**: `SKILL.md:3,12-18,34-39`; `references/commands.md:3-7` **Vulnerability Type**: Unverified out-of-package tool and instruction delegation **Risk Level**: High ### Vulnerable Code `scripts/opencli.sh:4`: ```bash exec /Users/ShiXin/.openclaw/skills/opencli/scripts/opencli.sh "$@" ``` `SKILL.md:3,12-18`: ```markdown description: Deprecated compatibility alias for the canonical `opencli` skill. Use only when an older note, memory, or prompt still refers to `opencli-exec`; then immediately follow the canonical `opencli` skill at `/Users/ShiXin/.openclaw/skills/opencli/SKILL.md`. ``` ```markdown The canonical skill is now: ```bash /Users/ShiXin/.openclaw/skills/opencli/SKILL.md ``` Use the canonical wrapper: ```bash /Users/ShiXin/.openclaw/skills/opencli/scripts/opencli.sh <args...> ``` ``` `SKILL.md:34-39`: ```markdown ## References See: - `/Users/ShiXin/.openclaw/skills/opencli/SKILL.md` - `/Users/ShiXin/.openclaw/skills/opencli/references/commands.md` ``` `references/commands.md:3-7`: ```markdown Use the canonical cookbook instead: ```bash /Users/ShiXin/.openclaw/skills/opencli/references/commands.md ``` ``` ### Technical Analysis The package does not contain its effective implementation. Instead, it transfers instruction authority and process execution to files at a fixed absolute path outside the audited project. The target files were not included in the supplied artifact, so their contents, integrity, ownership, and permissions could not be verified during this audit. If another local process or user can create or modify files under the referenced path, that party can replace the expected skill instructions or wrapper with attacker-controlled content. Subsequent use of this compatibility alias would then load unreviewed instructions or execute attacker-controlled code under the invoking agent's privileges. The shell wrapper correctly preserves argum ...[truncated 1712 chars]
- Remediation
- ## Remediation Suggestions 1. Bundle the canonical implementation and its instructions inside the reviewed package rather than delegating to mutable files outside the project. 2. If external delegation is unavoidable, resolve the component through a trusted installation mechanism and pin an approved version and cryptographic digest. 3. Before execution, verify the target's canonical path, regular-file status, ownership, permissions, and expected digest. Refuse execution when any check fails. 4. Ensure the external directory and all parent directories are not writable by untrusted users or processes. 5. Avoid hard-coded, user-specific absolute paths. Use a securely configured installation root while preventing environment-variable or search-path substitution by untrusted input. 6. Apply the same validation to externally referenced `SKILL.md` and documentation files because they can influence agent behavior even when they are not executable. 7. Keep `"$@"` when forwarding arguments, as it correctly preserves argument boundaries. 8. Add automated tests that verify missing, replaced, symlinked, incorrectly owned, overly writable, or digest-mismatched external targets are rejected safely.