T07 · Tool Hijacking and Spoofing
Error
- Location
SKILL.md:333- Finding
Untrusted Local Script Discovery and Execution
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 333–338
Vulnerability Type: Untrusted tool discovery and execution
Risk Level: HighVulnerable Code Snippet:
markdown **必须操作**：执行工作区根目录的脚本： ```bash python scripts/md_to_html.py --input "报告.md" --output "报告.html" --title "标题"如脚本在预期路径找不到，先用
glob搜索md_to_html.py定位后另存为临时文件运行。脚本是稳定的转换工具，不需修改。确保输出 HTML 在浏览器中离线可打开。text ### Technical Analysis The Skill mandates execution of `scripts/md_to_html.py`. If that expected file is absent, it directs the Agent to search for any file named `md_to_html.py`, copy it to a temporary location, and execute it. The audited project contains only `SKILL.md`; the expected converter is not bundled and therefore cannot be verified as trusted. Filename-based discovery across a workspace does not establish file provenance or integrity. An attacker who can place a same-named script in a searchable directory can cause that script to be selected as the purported converter. Copying the discovered script to a temporary file does not make it trustworthy. Executing it with Python gives the script the same operating-system permissions, environment access, filesystem access, and potentially network access available to the Agent process. ### Attack Path 1. The expected project-relative `scripts/md_to_html.py` is absent, as it is in the audited artifact. 2. An attacker places a malicious file named `md_to_html.py` elsewhere in the searchable workspace. 3. The Agent follows the Skill instructions and uses a glob search to locate a same-named file. 4. The Agent copies the attacker-controlled script to a temporary file without validating its origin or cryptographic digest. 5. The Agent invokes the copied file with Python. 6. The malicious script executes with the Agent process's permissions and can perform arbitrary actions available in that environment. ### Impact Assessment Successful exploitation enables arbit ...[truncated 732 chars]- Remediation
View remediation
Remediation Suggestions
- Bundle the reviewed
md_to_html.pyconverter inside the Skill package at a fixed, project-relative path. - Resolve the converter path relative to the trusted Skill directory rather than the current working directory.
- Remove the instruction to discover and execute same-named scripts from arbitrary workspace locations.
- Fail safely and report the missing dependency when the bundled converter is unavailable.
- Verify the converter against a pinned cryptographic digest before execution.
- Reject symbolic links and ensure the resolved path remains inside the trusted Skill directory.
- Run conversion in a restricted environment with minimal filesystem permissions, no unnecessary credentials, and disabled network access.
- Prefer an audited in-process Markdown conversion library or a non-executable fallback over dynamically locating Python scripts.
- If a temporary file is unavoidable, create it securely with restrictive permissions; however, secure temporary-file handling must not replace provenance and integrity validation.
- Bundle the reviewed