T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/trigger-evaluator.sh:4- Finding
Unverified Delegation to an External Executable
- Content
View full analysis
&2 exit 1 } exec "$ENGINE" ``` ### Technical Analysis The skill delegates its primary evaluation operation to an executable outside the audited project directory. Before execution, the wrapper checks only whether the target has its executable permission set. It does not validate the target's owner, permissions, cryptographic integrity, or whether the path resolves through a symbolic link. The external dependency is disclosed in `SKILL.md`, so no concealed malicious payload was identified in the packaged files. Nevertheless, the effective behavior of the `evaluate` command cannot be determined from this package alone. If another user or compromised process can replace the engine, modify its contents, or redirect its path through a symbolic link, a legitimate invocation of the skill will execute attacker-controlled code. ### Attack Path 1. An attacker obtains write access to `/home/cmart/.openclaw/workspace/scripts/stale_missions_engine.sh` or one of its parent directories. 2. The attacker modifies the engine or replaces it with an executable symbolic link or malicious program. 3. A user or agent invokes: ```sh trigger-evaluator.sh evaluate stale_missions_alert ``` 4. The wrapper's executable check succeeds because the substituted target is executable. 5. `exec "$ENGINE"` transfers control to the attacker-controlled program under the privileges of the invoking account. ### Impact Assessment Successful exploitation provides arbitrary command execution with the privileges of the user running the skill. The resulting access may include local files, environment vari ...[truncated 325 chars]- Remediation
View remediation