T07 · Tool Hijacking and Spoofing
Error
- Location
- p2p.js:13
- Finding
- Unverified External Plugin Execution Outside the Skill Package<![CDATA[ ## Vulnerability Details **File Location**: `p2p.js:13-24` **Vulnerability Type**: Unverified execution of an external local component **Risk Level**: High ### Vulnerable Code ```js const path = require("path"); const { execFileSync } = require("child_process"); const pluginDir = path.resolve(__dirname, "..", ".."); const entry = path.join(pluginDir, "dist", "index.js"); const args = process.argv.slice(2); try { const result = execFileSync("node", [entry, ...args], { env: process.env, encoding: "utf-8", timeout: 30000, stdio: ["pipe", "pipe", "pipe"], }); ``` ### Technical Analysis The wrapper resolves its implementation to `../../dist/index.js`, a file outside the audited Skill directory, and executes it without verifying its identity or integrity. The referenced implementation is not included in the project, so its behavior cannot be validated against the functionality described in `SKILL.md`. Every documented Skill command is delegated to this external file. The delegated process also receives the complete environment through `env: process.env`, potentially including credentials and other sensitive configuration unrelated to P2P operation. Using `execFileSync` with an argument array prevents conventional shell metacharacter injection through command arguments. However, that protection does not address substitution or modification of the external `dist/index.js` file itself. Any party capable of controlling that path can determine the effective behavior of all legitimate-looking Skill commands. ### Attack Path 1. An attacker gains the ability to create or replace the file resolved as `../../dist/index.js` relative to `p2p.js`. 2. The user or Agent invokes a documented command such as `status`, `list`, or `call`. 3. The wrapper starts Node.js with the attacker-controlled file as its entry point. 4. The substituted implementation executes with the same operating-system privileges as the Agent process. 5. It can inspect i ...[truncated 917 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bundle the executable implementation within the reviewed Skill package and resolve it from a fixed path beneath `__dirname`. 2. Before execution, canonicalize the entry path and verify that it remains inside an approved directory. 3. Protect the implementation with package-signature or cryptographic-hash verification and fail closed when verification fails. 4. Ensure the implementation and its parent directories are not writable by less-trusted users or processes. 5. Replace `env: process.env` with an explicit allowlist containing only variables required for P2P operation. 6. Document the actual transport, authentication, identity-storage, and relay requirements so they can be reviewed against the implementation. 7. Prefer importing a verified local module directly rather than spawning an opaque external entry point, where architectural constraints permit. ]]>