T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/batch-generate.sh:51- Finding
Working-Directory-Dependent Script Invocation Enables Local Tool Hijacking
- Content
View full analysis
&1; then SUCCESS=$((SUCCESS + 1)) echo " ✓ Saved to: $OUTPUT_FILE" else FAILED=$((FAILED + 1)) echo " ❌ Failed" fi ``` ### Technical Analysis The batch script invokes `./agnes-image-2.1.sh` relative to the process's current working directory instead of resolving the legitimate companion script relative to `batch-generate.sh`. The current working directory is controlled by the caller and does not necessarily correspond to the project's `scripts` directory. Consequently, a file named `agnes-image-2.1.sh` in the current directory can replace the intended image-generation tool. Because the invoked process inherits the batch script's environment, an attacker-controlled replacement can access `ANGES_API_KEY` or `AGENT_ANGES_API_KEY`, along with any other credentials and environment variables available to the user. It executes with the same operating-system privileges as the user running the batch operation. ### Attack Path 1. An attacker creates a malicious executable named `agnes-image-2.1.sh` in a directory the victim may use as their working directory. 2. The attacker causes or persuades the victim to run the legitimate `scripts/batch-generate.sh` while that directory is the current working directory. 3. At line 51, the batch script resolves `./agnes-image-2.1.sh` to the attacker-controlled file rather than the packaged companion script. 4. The malicious file executes with the victim's user privileges. 5. The malicious process reads inherited environment variables, including the Agnes API key, and can execute arbitrary commands available to that user. ### Impact Assessment Successful exploitation provides arbitrary command execution ...[truncated 416 chars]- Remediation
View remediation
&2 exit 1 fi if "$GENERATOR" text "$PROMPT" "$SIZE" "$OUTPUT_FILE" 2>&1; then SUCCESS=$((SUCCESS + 1)) else FAILED=$((FAILED + 1)) fi ``` Additional hardening measures: - Verify that the resolved generator is a regular file owned by the expected user or package owner. - Do not search `PATH` or the current working directory for security-sensitive companion scripts. - Run the Skill with only the environment variables it requires. - Use a narrowly scoped, revocable API key so compromise of the process environment has limited impact. ]]>