T07 · Tool Hijacking and Spoofing
- Location
scripts/wechat_group_operator.py:12- Finding
Unvalidated Execution of an External Sender Script
- Content
View full analysis
Vulnerability Details
File Location:
scripts/wechat_group_operator.py, lines 12 and 75–88
Vulnerability Type: Unvalidated execution of a mutable external tool
Risk Level: MediumVulnerable Code:
python SENDER_SCRIPT = Path(r"C:\Users\Lenovo\.openclaw\workspace\skills\wechat-desktop-sender\scripts\wechat_send.py")python def send_to_group(group_name, message, dry_run=False): cmd = [ sys.executable, str(SENDER_SCRIPT), "--to", group_name, "--message", message, "--verify-title", ] if dry_run: return {"cmd": cmd, "stdout": "DRY_RUN", "returncode": 0} result = subprocess.run(cmd, capture_output=True, text=True, encoding="utf-8", errors="replace") return { "cmd": cmd, "stdout": result.stdout, "stderr": result.stderr, "returncode": result.returncode, }Technical Analysis
The skill invokes a Python file located outside the reviewed project and assumes that the file is the legitimate WeChat sender. Before execution, it does not validate the external file's canonical path, ownership, permissions, cryptographic hash, signature, or provenance.
Although the subprocess call uses an argument list rather than a shell and therefore does not expose a direct shell-injection flaw, the external script itself becomes an unverified executable trust boundary. A local actor or compromised component with write access to that path could replace or modify
wechat_send.py. The next non-dry-run invocation would execute the substituted Python code with the same operating-system identity and privileges as this skill.The hard-coded, user-specific path also makes the selected implementation environment-dependent and prevents the audited package from controlling which exact sender code is executed.
Attack Path
- An attacker gains write access to `C:\Users\L ...[truncated 1272 chars]
- Remediation
View remediation
Remediation Suggestions
- Bundle the sender implementation inside the reviewed package where feasible, and audit it together with this skill.
- If an external sender is required, obtain its location from a trusted, access-controlled configuration rather than a user-specific hard-coded path.
- Resolve the configured path to its canonical form and verify that it remains under an explicitly approved directory.
- Verify file and parent-directory ownership and permissions. Refuse execution when untrusted users or components can modify them.
- Pin an approved cryptographic hash or verify a digital signature before every execution, and fail closed on mismatch.
- Run the sender with the minimum necessary operating-system privileges and isolate it from unrelated files, secrets, and network resources where practical.
- Log the canonical path and verified sender version or digest to support incident investigation.
- Retain the argument-array subprocess invocation and do not enable
shell=True.