T07 · Tool Hijacking and Spoofing
Warning
- Location
- SKILL.md:94
- Finding
- Unaudited Local Scripts Control Cryptocurrency Repair Operations## Vulnerability Details **File Location**: `SKILL.md:43-49`, `SKILL.md:94-100`, and `INSTALL.md:22-26` **Vulnerability Type**: T07: Tool Hijacking and Spoofing **Risk Level**: Medium The Skill delegates state-changing cryptocurrency operations to local scripts that are not included in the audited package. Installation guidance requires only confirming that the referenced scripts exist; it does not verify their contents, origin, version, checksum, ownership, or repository identity. **Relevant code from `SKILL.md:43-49`:** ```markdown Step 1: Scan all proposal conditions and classify gaps. Step 2: Report detections by repair class: - `activateMissing` - `riskLpMissing` - `resultMissing` - `claimPending` ``` **Relevant code from `SKILL.md:94-100`:** ```markdown ## Project Scripts - `scripts/pbft-activate-and-add-risklp.mjs` - `scripts/pbft-submit-all-condition-results.mjs` - `scripts/pbft-submit-real-results-ba0c-resolved-only.mjs` - `scripts/pbft-submit-remaining-no-ba0c.mjs` - `scripts/pbft-claim-rewards-profile-method.mjs` ``` **Relevant code from `INSTALL.md:22-26`:** ```markdown ## Post-install check Open `SKILL.md` and confirm the referenced recovery scripts exist in the local project checkout before using this skill. Restart the agent runtime after installation. ``` ### Technical Analysis None of the five referenced repair scripts is present in the audited package. The package therefore establishes trust in scripts found elsewhere in a local project checkout. Checking only whether an expected path exists does not establish that the file is authentic or safe. This creates a tool-substitution boundary: a malicious or compromised checkout can provide files under the documented names, causing apparently legitimate repair requests to execute attacker-controlled logic. The affected operations include proposal activation, risk-liquidity addition, result submission, and reward claiming. The ...[truncated 2232 chars]
- Remediation
- ## Remediation Suggestions 1. Bundle the required scripts inside the reviewed Skill package so that operational code and instructions share the same audit boundary. 2. If external scripts are unavoidable, pin them to a specific trusted repository commit and publish cryptographic hashes for every executable file. 3. Verify repository identity, commit signature, and file hashes before execution; do not treat file existence as sufficient validation. 4. Resolve scripts relative to a trusted, immutable Skill directory rather than the current workspace or an arbitrary checkout. 5. Reject symbolic links, path traversal, writable parent directories, and unexpected file ownership or permissions. 6. Apply least privilege by isolating scripts, limiting filesystem and network access, and exposing only the minimum wallet capability required for the selected repair. 7. Before every state-changing operation, display and require explicit confirmation of the chain ID, contract address, method, arguments, recipient, token amount, native value, gas limits, and expected state changes. 8. Simulate transactions before signing and compare the simulation against an allowlist of expected contracts and methods. 9. Separate read-only proposal scanning from transaction execution so detection does not require signing credentials. 10. Document the trusted script version and fail closed when a script is missing, modified, or cannot be authenticated.