T07 · Tool Hijacking and Spoofing
Warning
- Location
- scripts/bilibili_extract.py:316
- Finding
- Execution of an Unverified External Shell Script## Vulnerability Details **File Location**: `scripts/bilibili_extract.py:26, 273-274, 316-319` **Vulnerability Type**: Unverified execution of a mutable external tool **Risk Level**: Medium ### Vulnerable Code ```python ASR_SCRIPT = Path.home() / ".openclaw/workspace/scripts/speech-to-text.sh" ``` ```python if not ASR_SCRIPT.exists(): return None, None ``` ```python result = subprocess.run( ["bash", str(ASR_SCRIPT), str(wav_path)], capture_output=True, text=True, timeout=300 ) ``` ### Technical Analysis The extraction script invokes `speech-to-text.sh` from a mutable workspace location outside the audited package. The only validation performed before execution is an existence check. The code does not verify that the path is a regular file, reject symbolic links, validate file ownership or permissions, or compare the file against a trusted integrity hash. The use of an argument list rather than `shell=True` prevents direct command injection through `wav_path`, but it does not protect against replacement of the shell script itself. Anyone who can modify the workspace script path can determine the commands executed by the ASR fallback. Because the external script is not included in the audited project, its behavior and downstream network or command execution cannot be verified from this package. ### Attack Path 1. An attacker gains write access to `~/.openclaw/workspace/scripts/`, or causes `speech-to-text.sh` to be replaced with a symbolic link to an attacker-controlled file. 2. The attacker places arbitrary shell commands in the replacement script. 3. A user processes a Bilibili video for which CC and AI subtitles are unavailable. 4. The application enters the audio-transcription fallback. 5. Python invokes the attacker-controlled file through `bash`. 6. The commands execute with the same operating-system identity and permissions as the Agent process. ### Impact Assessment Success ...[truncated 512 chars]
- Remediation
- ## Remediation Suggestions 1. Bundle the ASR implementation inside the reviewed Skill package rather than executing a mutable workspace script. 2. If an external executable must be supported, require the user to configure its path explicitly rather than relying on a fixed shared workspace location. 3. Resolve the path with `Path.resolve(strict=True)` and reject paths that escape an approved directory. 4. Use `lstat()` to reject symbolic links and require the target to be a regular file. 5. Verify that the file is owned by the expected operating-system account and is not writable by group or other users. 6. Pin and verify a cryptographic hash or signed manifest before every execution. 7. Run transcription in a restricted subprocess or container with minimum filesystem and network access. 8. Preserve argument-array invocation and continue avoiding `shell=True`. 9. Document the trust boundary and require explicit confirmation before first use of an external ASR program.