T07 · Tool Hijacking and Spoofing
- Location
playwright-cmd.js:1- Finding
CLI Loads and Executes an Unaudited Module from an External Absolute Path
- Content
View full analysis
Vulnerability Details
File Location:
playwright-cmd.js:1
Vulnerability Type: External module hijacking through a hardcoded absolute path
Risk Level: HighVulnerable Code:
javascript const { fetchWithPlaywright, fetchElementAndScreenshot } = require('/Users/chenkuan/.openclaw/workspace/毕业论文/论文工程/playwright-crawler-v3.js');Technical Analysis
The command-line entry point does not load the audited
playwright-crawler-v3.jsbundled in the project. Instead, Node.js is instructed to load and immediately evaluate a JavaScript module from an absolute path outside the package.The contents and integrity of that external file are not controlled by this project. If the path exists and another local user, compromised process, or writable workspace can modify it, the imported module can be replaced with arbitrary JavaScript. Node.js executes top-level module code as soon as
require()is evaluated, before either imported function is invoked.This behavior also conflicts with the documented relative import in
SKILL.md, which presentsrequire('./playwright-crawler-v3.js'). On systems where the hardcoded path does not exist, the CLI fails to start. On systems where it does exist, the actual executed implementation may differ from the audited package.Attack Path
- An attacker obtains write access to
/Users/chenkuan/.openclaw/workspace/毕业论文/论文工程/playwright-crawler-v3.js, or causes an attacker-controlled file to be created at that location. - The attacker inserts top-level JavaScript that performs arbitrary actions, then optionally exports functions with the expected names to avoid detection.
- A user or AI Agent invokes
playwright-cmd.jsthrough the advertised Skill command or an npm script. - Node.js resolves the hardcoded path and evaluates the attacker-controlled module immediately.
- The malicious code runs with the same operating-system identity and permissions as the Skill process ...[truncated 642 chars]
- An attacker obtains write access to
- Remediation
View remediation
Remediation Suggestions
Load only the implementation shipped with the package:
javascript const { fetchWithPlaywright, fetchElementAndScreenshot } = require('./playwright-crawler-v3.js');For explicit and location-independent resolution, anchor the path to the current module:
javascript const path = require('path'); const { fetchWithPlaywright, fetchElementAndScreenshot } = require(path.join(__dirname, 'playwright-crawler-v3.js'));Additional hardening measures:
- Remove all hardcoded developer-specific paths from executable code.
- Package and execute only reviewed source files located beneath the Skill root.
- Add a clean-environment test that starts the CLI without relying on files outside the package.
- Consider package integrity checks or signed release artifacts where the Skill distribution system supports them.
- Ensure the package directory and its executable modules are not writable by untrusted users.