T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/deploy.sh:8- Finding
Deployment Executes Unverified Code from Outside the Audited Skill
- Content
View full analysis
/dev/null || true ``` The generated command subsequently gives these copied modules import precedence: ```python sys.path.insert(0, OPTIMIZER_DIR) sys.path.insert(0, os.path.join(OPTIMIZER_DIR, 'evaluator')) ``` It then imports and executes the external implementation: ```python from auto_evaluator import CodeEvaluator evaluator = CodeEvaluator() result = evaluator.evaluate(code, task) ``` The generated command is copied into the installed Skill and exposed through the user's command path: ```bash cp "$HERMES_DIR/bin/code-eval" "$SKILL_DIR/scripts/code-eval" ln -sf "$HERMES_DIR/bin/code-eval" "$HOME/bin/code-eval" 2>/dev/null || true ``` ### Technical Analysis The deployment does not use an evaluator implementation included in the audited project. Instead, it copies Python modules from a hard-coded directory outside the Skill package. The copied files are not checked for expected ownership, permissions, content hashes, signatures, or source provenance. The generated `code-eval` executable places the copied directories at the beginning of `sys.path`. Consequently, Python imports `auto_evaluator.py` and related modules from this unverified source. Importing a Python module executes its top-level statements before `CodeEvaluator` is instantiated, so malicious code does not need to wait for the `evaluate` method to be called. This also creates a review-boundary problem: auditing the two files in this project cannot establish the behavior of the deployed ...[truncated 1360 chars]- Remediation
View remediation