T07 · Tool Hijacking and Spoofing
- Location
SKILL.md:31- Finding
Unaudited External Script Execution and Disclosure of Credential Metadata
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, lines 31–39
Vulnerability Type: Execution of an unbundled external tool with access to a sensitive API credential
Risk Level: MediumVulnerable Code Snippet:
markdown ## Setup - **API Key:** `op://OpenClaw/Apify API Credentials/credential` (also in gateway plist as `APIFY_API_KEY`) - **Dashboard:** https://console.apify.com (account: redditech) - **Plan:** FREE ($5/mo credit) - **Script:** `python3 scripts/apify-run.py <actor> <input_json>` ## Running an Actor ```bashThe command immediately following this range invokes the script through the absolute path
/Users/loki/.openclaw/workspace/scripts/apify-run.py.Technical Analysis
The Skill does not contain the referenced
apify-run.pyimplementation. Instead, it directs the Agent to execute a mutable script outside the audited project. Consequently, the code that receives actor names, scraping inputs, target URLs, and potentially theAPIFY_API_KEYcannot be reviewed or integrity-checked as part of this Skill.This creates a tool-hijacking boundary: a legitimate-looking Skill invocation can execute attacker-controlled logic if the external script is replaced or modified. The documentation also discloses the precise 1Password item path, environment-variable name, gateway plist location, local username/path, and Apify account identifier. These details are not API-key values themselves, but they reduce the effort needed to locate and target the credential.
The intended connection to
api.apify.comis necessary for the declared cloud-scraping functionality. The security concern is not the declared Apify transmission itself, but the absence of an auditable implementation and enforceable destination restriction for the executable handling that transmission.Attack Path
- An attacker obtains write access to
/Users/loki/.openclaw/workspace/scripts/apify-run.py, replaces ...[truncated 1892 chars]
- An attacker obtains write access to
- Remediation
View remediation
Remediation Suggestions
- Bundle
apify-run.pyinside the Skill package so the executable implementation is included in security review and version control. - Invoke the bundled script through a repository-relative, canonicalized path rather than a user-specific absolute path.
- Protect the script from unauthorized modification using restrictive file permissions and package integrity or signature verification.
- Remove the 1Password item path, gateway plist reference, local username, absolute filesystem path, and account identifier from distributable documentation. Retain only the declared
APIFY_API_KEYenvironment-variable requirement. - Pass the API key only through the process environment or a narrowly scoped secret provider. Never include it in command-line arguments, logs, error messages, datasets, or actor inputs.
- Create a dedicated Apify key with the minimum permissions necessary to run approved actors. Configure spending limits, key rotation, revocation procedures, and usage monitoring.
- Restrict outbound connections from the runner to the required Apify API hostname over HTTPS. Reject redirects or unexpected destinations where feasible.
- Validate actor identifiers against an explicit allowlist and parse input as JSON without shell interpolation. Apply limits to item counts, timeouts, and submitted data sizes.
- Warn users not to submit credentials, private URLs, session tokens, or sensitive personal data to cloud actors, because actor inputs and results are processed on Apify infrastructure.
- Pin or explicitly approve actor identifiers and document that third-party actor implementations remain outside the audited package and may change independently.
- Bundle