T07 · Tool Hijacking and Spoofing
Error
- Location
- skill.md:12
- Finding
- Execution of an Unbundled External Script with OAuth Credential Access## Vulnerability Details **File Location**: `skill.md`, lines 12-28 **Vulnerability Type**: Execution of an unaudited absolute-path tool with access to local OAuth credentials **Risk Level**: High ```markdown Generate high-quality images using the internal Google Antigravity API (Gemini 3 Pro Image). This skill bypasses the need for browser automation by using the `daily-cloudcode-pa.sandbox` endpoint directly with your OAuth credentials. ## Prerequisites - **Google Antigravity OAuth Profile**: Must be present in your OpenClaw auth-profiles.json. - **Node.js**: Available in the environment. - **Security Note**: This skill reads local OAuth tokens from your profile to authenticate with Google's API. This is expected behavior for internal tool use. ## Usage ### Direct Script Execution ```bash /home/ubuntu/clawd/skills/antigravity-image-gen/scripts/generate.js \ --prompt "A futuristic city on Mars" \ --output "/tmp/mars.png" \ --aspect-ratio "16:9" ``` ``` ### Technical Analysis The project contains only `skill.md` and `_meta.json`; the referenced `scripts/generate.js` implementation is not included in the audited package. The instructions therefore transfer execution to an absolute-path program outside the reviewed project boundary. The external program is expected to read OAuth tokens from `auth-profiles.json` and communicate with an API. Because its implementation is absent, the audit cannot verify its API destination validation, token handling, output-path handling, logging behavior, or resistance to command and argument injection. The reviewed skill content also provides no integrity check, fixed digest, ownership requirement, or permission check for the external executable. If an attacker can create or replace the file at the documented absolute path, legitimate-looking image-generation requests would execute attacker-controlled logic. This is a tool-hijacking risk because the trusted skill acts as ...[truncated 2153 chars]
- Remediation
- ## Remediation Suggestions 1. Include `scripts/generate.js` inside the published skill package so its implementation can be reviewed together with the instructions. 2. Invoke the script through a package-relative, canonically resolved path rather than a hard-coded path outside the audited artifact. 3. Verify the script's integrity before execution using a trusted package signature or pinned cryptographic digest. 4. Ensure the script and all parent directories are owned by a trusted account and are not writable by untrusted users or unrelated processes. 5. Grant access only to the specific OAuth profile required for image generation; do not expose the complete credential store when a scoped token can be supplied. 6. Use OAuth scopes limited to the minimum API permissions necessary, with short token lifetimes and straightforward revocation. 7. Prevent tokens from appearing in command-line arguments, standard output, error messages, generated files, or diagnostic logs. 8. Pin and validate the expected API origin, enforce TLS certificate verification, and reject redirects to untrusted origins. 9. Validate all prompt, aspect-ratio, and output-path inputs in the bundled implementation. Restrict output to approved directories and avoid shell-based command construction. 10. Run image generation in a sandbox with restricted filesystem, network, and process permissions. 11. Add automated packaging checks that fail publication when documentation references executable files absent from the released artifact.