T07 · Tool Hijacking and Spoofing
Error
- Location
run.sh:4- Finding
Execution of Unverified Code Outside the Skill Package
- Content
View full analysis
&2 exit 2 ;; esac ``` ### Technical Analysis The launcher derives `ROOT_DIR` by traversing three parent directories from the directory containing `run.sh`. It then executes Python scripts under that derived root rather than scripts contained in the audited Skill package. The referenced Python files are absent from the supplied project artifact. Consequently, the effective behavior of `run.sh` depends on external, unaudited files at: - `$ROOT_DIR/scripts/data/run_daily_timeout_report.py` - `$ROOT_DIR/scripts/data/run_daily_timeout_trend_report.py` No canonical-path containment check, ownership validation, permission check, or integrity verification is performed before execution. If the Skill is relocated, unpacked into an unexpected directory hierarchy, or used in a project where another party can modify the referenced scripts, an attacker can substitute arbitrary Python code while preserving the legitimate-looking `run.sh day` or `run.sh trend` invocation. All additional command-line arguments are passed to the external scripts. This is not directly a shell-command-injection issue because `"$@"` preserves argument boundaries, but the safety of argument processing cannot be assessed because the receiving implementations were not supplied. ### Attack Path 1. The attacker obtains write access to the derived `$ROOT_DIR/scripts/data/` directory or controls the project into which the Skill is i ...[truncated 1248 chars]- Remediation
View remediation
&2 exit 1 ;; esac ``` 3. Fail closed if the implementation is missing, is a symbolic link, is not a regular file, or is writable by untrusted users. 4. Distribute a signed manifest or trusted cryptographic hashes for executable files and verify their integrity before execution. 5. If project-level scripts must remain external, explicitly define the trusted project root through a validated configuration value rather than inferring it through parent-directory traversal. 6. Include the referenced Python implementations in future audits so their database queries, argument handling, filesystem writes, output sanitization, and network behavior can be reviewed. ]]>