T07 · Tool Hijacking and Spoofing
- Location
scripts/start-senseaudio-floating-audio-assistant.sh:7- Finding
Execution of Mutable External Workspace Scripts Without Trust Validation
- Content
View full analysis
Vulnerability Details
File Location:
scripts/common.sh:4-8,scripts/start-senseaudio-floating-audio-assistant.sh:4-24,scripts/stop-senseaudio-floating-audio-assistant.sh:4-14, andscripts/check-senseaudio-floating-audio-assistant-setup.sh:4-49
Vulnerability Type: Untrusted external tool delegation
Risk Level: MediumVulnerable Code
scripts/common.sh:4-8:bash SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" SKILL_DIR="$(cd "$SCRIPT_DIR/.." && pwd)" WORKSPACE_DIR="$(cd "$SKILL_DIR/../.." && pwd)" TOOL_DIR="$WORKSPACE_DIR/tools/realtime_interpreter" STATE_DIR="$WORKSPACE_DIR/state/realtime_interpreter"scripts/start-senseaudio-floating-audio-assistant.sh:7-24:bash START_SCRIPT="$TOOL_DIR/start_system_subtitle_overlay.sh" ENV_FILE="$WORKSPACE_DIR/.env" if [ ! -f "$START_SCRIPT" ]; then echo "SenseAudio floating audio assistant launcher not found: $START_SCRIPT" >&2 exit 1 fi if ! command -v swiftc >/dev/null 2>&1; then echo "swiftc not found. Install Xcode Command Line Tools before launching the native overlay." >&2 exit 1 fi if [ ! -f "$ENV_FILE" ]; then echo "Warning: $ENV_FILE is missing. SenseAudio ASR/TTS/music features may not work until SENSEAUDIO_API_KEY is configured." >&2 fi exec bash "$START_SCRIPT" "$@"scripts/stop-senseaudio-floating-audio-assistant.sh:7-14:bash STOP_SCRIPT="$TOOL_DIR/stop_system_subtitle_overlay.sh" if [ ! -f "$STOP_SCRIPT" ]; then echo "SenseAudio floating audio assistant stop script not found: $STOP_SCRIPT" >&2 exit 1 fi exec bash "$STOP_SCRIPT" "$@"scripts/check-senseaudio-floating-audio-assistant-setup.sh:7,45-49:bash CHECK_SCRIPT="$TOOL_DIR/check_system_audio_setup.sh" if [ -f "$CHECK_SCRIPT" ]; then bash "$CHECK_SCRIPT" else echo "Audio setup checker not found: $CHECK_SCRIPT" >&2 exit 1 fiTechnical Analysis
The Skill's start, stop, and setup-check entry points delegate execution to shell scripts under the su ...[truncated 2587 chars]
- Remediation
View remediation
Remediation Suggestions
-
Prefer package-local, reviewed implementations. Bundle the start, stop, and setup-check logic inside the Skill package rather than executing mutable workspace scripts.
-
Pin external toolchain integrity. If external delegation is required, publish expected SHA-256 hashes or verify a signed manifest before every execution. Reject missing, changed, or unsigned targets.
-
Validate canonical paths. Resolve each target with a canonical-path operation and verify that it remains under one explicitly approved toolchain directory. Reject symbolic-link redirection and unexpected path traversal.
-
Enforce trusted ownership and permissions. Before execution, verify that the target and every parent directory are owned by the expected account and are not writable by untrusted users or groups.
-
Avoid check-then-execute races. Integrity and metadata checks followed by pathname-based execution can be raced. Where practical, use a trusted immutable installation directory or platform-supported code-signing verification.
-
Minimize inherited secrets. Launch the external toolchain with an allowlisted environment containing only variables required for the requested feature. Do not expose unrelated workspace credentials.
-
Fail closed with clear diagnostics. If ownership, path, signature, or hash checks fail, stop without executing the external script and report which trust check failed.
-
Document the trust boundary. State that the external realtime interpreter toolchain is executable code that must be installed from a trusted source and protected from modification.
-