T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/web_search.py:16- Finding
External Development File Takes Precedence Over the Bundled Search Implementation
- Content
View full analysis
Path: for candidate in _CANDIDATES: if candidate.exists(): return candidate looked = "\n ".join(str(candidate) for candidate in _CANDIDATES) sys.stderr.write("tavily_search.py not found. Looked in:\n " + looked + "\n") raise SystemExit(2) if __name__ == "__main__": target = _resolve_target() sys.argv[0] = str(target) runpy.run_path(str(target), run_name="__main__") ``` ### Technical Analysis The search launcher checks an external development-tree path before the implementation bundled inside the Skill. If the following path exists, it takes precedence: ```text SCRIPT_ROOT.parents[2]/shared/web_search/tavily_search.py ``` The selected file is then executed directly with `runpy.run_path(..., run_name="__main__")`. There is no verification that the external file belongs to the audited Skill, has an expected hash, is owned by a trusted user, or is not writable by a less-privileged party. This creates a local tool-hijacking boundary: a legitimate invocation of `scripts/web_search.py` may execute Python code that was not included in or reviewed as part of this Skill. The bundled implementation is available, so preferring an external implementation is not necessary for normal packaged operation. Exploitation depends on an attacker or another process being able to create or modify the preferred external path. The code does not itself grant that access, but it turns such filesystem access into Python execution under the Agent's identity. ### Attack Path 1. An attacker, compromised development tool, or lower-trust process ...[truncated 1344 chars]- Remediation
View remediation