T07 · Tool Hijacking and Spoofing
Error
- Location
- scripts/setup.mjs:11
- Finding
- Out-of-Project Fallback Allows Untrusted Code Execution<![CDATA[ ## Vulnerability Details **File Location**: - `scripts/setup.mjs:11-22` - `scripts/start-watcher.mjs:10-28` - `scripts/start-mcp.mjs:10-31` **Vulnerability Type**: `T07: Tool Hijacking and Spoofing` **Risk Level**: High ### Vulnerable Code `scripts/setup.mjs:11-22`: ```js let entry; try { const pkgJson = require.resolve('@hypelens/hypelens-agent-guard/package.json'); entry = join(dirname(pkgJson), 'bin', 'agent-guard.js'); } catch { entry = join(scriptsDir, '..', '..', 'bin', 'agent-guard.js'); } if (!existsSync(entry)) { console.error('Missing @hypelens/hypelens-agent-guard. Run: npm install'); process.exit(1); } process.argv = [process.argv[0], entry, 'setup', '--scripts-dir', scriptsDir, ...process.argv.slice(2)]; await import(pathToFileURL(entry).href); ``` `scripts/start-watcher.mjs:10-28`: ```js try { const pkgJson = require.resolve('@hypelens/hypelens-agent-guard/package.json'); const pkg = require(pkgJson); const binRel = (pkg.bin && pkg.bin['agent-guard-watcher']) || 'bin/agent-guard-watcher.js'; const entry = join(dirname(pkgJson), binRel); await import(pathToFileURL(entry).href); } catch (e) { try { const localEntry = join( dirname(fileURLToPath(import.meta.url)), '..', '..', 'bin', 'agent-guard-watcher.js', ); await import(pathToFileURL(localEntry).href); } catch { console.error('Missing dependency. Run: npm install (in this scripts/ folder)'); console.error(String(e && e.message ? e.message : e)); process.exit(1); } } ``` `scripts/start-mcp.mjs:10-31`: ```js try { const pkgJson = require.resolve('@hypelens/hypelens-agent-guard/package.json'); const pkg = require(pkgJson); const binRel = (pkg.bin && (pkg.bin['agent-guard-mcp'] || pkg.bin['agent-guard'])) || 'bin/agent-guard-mcp.js'; const entry = join(dirname(pkgJson), binRel); await import(pathToFileURL(entry).href); } catch (e) { try { const localEntry = join( dirname(file ...[truncated 2236 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove all `../../bin` fallback imports from the published Skill. - Fail closed if the integrity-pinned dependency cannot be loaded. - Catch dependency-resolution errors separately from runtime errors; do not activate a fallback when legitimate code throws during execution. - If a development fallback is necessary, require an explicit development-only flag. - Resolve the fallback with `realpath` and verify that it remains inside an explicitly trusted repository root. - Refuse to run fallback code when wallet credentials are present. - Execute sensitive trading components in a restricted process with minimal filesystem access and a tightly scoped signer. ]]>