T07 · Tool Hijacking and Spoofing
Error
- Location
- SKILL.md:9
- Finding
- Execution of an Unverified Script Outside the Skill Package<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 9-12 **Vulnerability Type**: Untrusted external local script execution **Risk Level**: High ### Vulnerable Code ```markdown 1. Run the analysis script to obtain the latest BTC/ETH data: ```bash python3 /home/hmzo/.openclaw/workspace/skills/public/crypto-market-analyzer/scripts/fetch_crypto_data.py --output json ``` ``` ### Technical Analysis The Skill directs the agent to execute a Python script through a hard-coded absolute path outside the audited project directory. The referenced script is not included in this artifact, so its source, integrity, ownership, permissions, and runtime behavior cannot be verified as part of the Skill audit. Python executes the contents of the referenced file with the permissions of the agent process. If another user, package, process, or compromised Skill can create or modify that file, the legitimate-looking command will execute attacker-controlled logic. The external script can also falsify its JSON output, causing the agent to generate manipulated cryptocurrency trading parameters. This is classified as tool hijacking because the Skill trusts a replaceable local analysis tool without validating its identity or integrity. ### Attack Path 1. An attacker obtains write access to the referenced script, its parent directory, or a deployment mechanism that populates that path. 2. The attacker creates or replaces `fetch_crypto_data.py` with malicious Python code while preserving the expected filename and optionally producing plausible JSON output. 3. A user invokes this Skill for a BTC/ETH trading brief. 4. The agent follows the mandatory first step and runs the hard-coded Python command. 5. The malicious script executes with the agent process's privileges. 6. The script may access files or credentials available to that process, perform network operations, alter local data, or return forged market information. 7. The agent may then present attacker-manipu ...[truncated 1062 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Bundle the analysis script inside the Skill package so it can be reviewed and distributed with the Skill. 2. Resolve the script through a validated package-relative path rather than a hard-coded path outside the project root. 3. Pin the script or its containing dependency to an immutable version and verify a cryptographic checksum or signature before execution. 4. Ensure the script and its parent directories are not writable by untrusted users or unrelated processes. 5. Execute the analyzer under a least-privilege account or sandbox with only the file and network access required for market-data retrieval. 6. Validate the analyzer's JSON output against a strict schema, including expected fields, types, timestamps, ranges, and data-source identifiers. 7. Fail closed if path validation, ownership checks, integrity verification, execution, or output validation fails. 8. Document the trusted source and update process for the analyzer so changes are subject to review before deployment. ]]>