T07 · Tool Hijacking and Spoofing
Error
- Location
- SKILL.md:58
- Finding
- Execution of Unbundled Scripts from a Mutable Shared Workspace<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 39, 58–59, and 79–80 **Vulnerability Type**: Execution-path hijacking through unverified external scripts **Risk Level**: High ### Vulnerable Code ```bash python3 scripts/wipo_search.py <start_date> <end_date> ``` ```bash cd ~/.openclaw/workspace python3 scripts/wipo_search.py <start_date> <end_date> ``` ```bash cd ~/.openclaw/workspace python3 scripts/wipo_generate_report.py wipo_reports/wipo_patent_weekly_<date>.json ``` ### Technical Analysis The Skill instructs the agent to change into `~/.openclaw/workspace` and execute `scripts/wipo_search.py` and `scripts/wipo_generate_report.py` using relative paths. Neither script is included in the audited project, which contains only `SKILL.md` and `references/target-rules.md`. The origin, contents, ownership, permissions, version, and integrity of the invoked scripts are therefore not controlled or validated by this Skill. Any user or process capable of writing to the shared workspace could create or replace these files. The resulting commands would then execute the substituted code under the identity and privileges of the agent running the Skill. This is a tool-hijacking risk because legitimate-looking Skill operations are delegated to mutable, unaudited implementations outside the reviewed package. ### Attack Path 1. An attacker obtains write access to `~/.openclaw/workspace/scripts/`, directly or through another compromised process or Skill. 2. The attacker creates or replaces `wipo_search.py` or `wipo_generate_report.py` with malicious Python code. 3. A user invokes the patent-report Skill, or an external scheduler invokes it according to the documented weekly workflow. 4. The agent changes into the shared workspace and executes the attacker-controlled script without checking its integrity. 5. The malicious script performs arbitrary actions available to the agent before optionally producing expected output to conceal the compromi ...[truncated 988 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Include `wipo_search.py` and `wipo_generate_report.py` inside the reviewed Skill package so their implementation is part of the audit boundary. 2. Resolve script paths relative to the immutable Skill installation directory rather than `~/.openclaw/workspace`. 3. Before execution, verify script ownership, permissions, and cryptographic hashes against trusted values distributed with the Skill. 4. Refuse execution if a script is missing, writable by untrusted users, located through a symbolic link, or fails integrity verification. 5. Pin Python and browser dependencies to reviewed versions with hashes and use an isolated virtual environment. 6. Run scraping and report generation with the minimum filesystem, credential, and network permissions required. 7. Keep generated reports in a dedicated output directory that is separate from executable code and not writable by unrelated Skills. 8. Validate the generated HTML before upload and ensure that only the intended report file can be passed to `rclone`. 9. Log the resolved executable paths and verified hashes to support incident investigation and reproducible operation. ]]>