T07 · Tool Hijacking and Spoofing
Warning
- Location
integrate_with_clawx.sh:48- Finding
Persistent PATH Modification Enables Command Shadowing
- Content
View full analysis
/dev/null; then echo 'export AGENCY_DIR="$HOME/.openclaw/agency-agents-zh"' >> ~/.bash_profile echo 'export PATH="$AGENCY_DIR:$PATH"' >> ~/.bash_profile echo "✅ 已添加到 ~/.bash_profile" else echo "✅ 环境变量已存在" fi # 4. 创建 Qwen 别名 echo "" echo "🔧 创建 Qwen 命令别名..." if ! grep -q "alias qwen-agency" ~/.bash_profile 2>/dev/null; then echo 'alias qwen-agency="python3 $HOME/.openclaw/skills/agency-orchestrator/qwen_extension.py"' >> ~/.bash_profile echo "✅ 已创建别名 qwen-agency" else echo "✅ 别名已存在" fi # 5. 刷新配置 source ~/.bash_profile 2>/dev/null ``` ### Technical Analysis The integration script permanently prepends `$HOME/.openclaw/agency-agents-zh` to the user's `PATH`. This directory is described as an Agent data and configuration directory rather than a dedicated, controlled executable directory. Because it appears before the existing `PATH`, any executable placed there with the same name as a legitimate command will be selected first by the shell. This creates a command-shadowing opportunity. The modification persists across future shell sessions because it is written to `~/.bash_profile`. The script also immediately sources the complete profile. Consequently, it executes all commands currently present in that profile, including unrelated or previously injected commands, in the context of the integration process. ### Attack Path 1. An attacker, compromised Agent component, or other process obtains write access to `~/.openclaw/agency-agents-zh`. 2. The attacker places an executable in that directory using the name of a commonly invoked command, such as `python3`, `git`, or another utility. 3. The user runs the integration script, which pre ...[truncated 828 chars]- Remediation
View remediation