T07 · Tool Hijacking and Spoofing
Warning
- Location
- SKILL.md:63
- Finding
- Execution of an Unbundled and Unverifiable External CRM Client## Vulnerability Details **File Location**: `SKILL.md:63-65` **Vulnerability Type**: Execution of an unverified local tool outside the audited package **Risk Level**: Medium ### Vulnerable Code ```bash python3 /root/.hermes/metaads/ghl_client.py --action update_opp_stage --opp-id <OPP_ID> --stage-id <STAGE_ID> ``` ### Technical Analysis The Skill directs the Agent to execute `/root/.hermes/metaads/ghl_client.py`, but this Python client is not included in the audited project. Consequently, its implementation, integrity, network destinations, credential handling, input validation, and side effects cannot be verified from the package. The effective behavior of the Skill therefore depends on mutable code outside its reviewed boundary. If the external file is replaced or modified, the documented command remains legitimate-looking while executing attacker-controlled logic. The absolute path under `/root` also indicates that the client may run in a privileged account context, although the documented command does not itself perform privilege escalation. The placeholders for the opportunity and stage identifiers are not accompanied by validation requirements. Their safety ultimately depends on the missing client implementation. ### Attack Path 1. An attacker, compromised installer, or another process with access to the host modifies or replaces `/root/.hermes/metaads/ghl_client.py`. 2. The Agent loads the Skill and follows its documented CRM-update procedure. 3. The Agent executes the substituted Python client. 4. The malicious client inherits the Agent's execution context and may access environment variables such as `GHL_API_KEY`, `GHL_LOCATION_ID`, and `HABILIS_API_KEY`. 5. The client can misuse those credentials, transmit lead or CRM data, alter unintended records, or perform other actions permitted by the local account. Exploitation requires prior ability to create or modify the referenced external file. The project itself does not contain code ...[truncated 826 chars]
- Remediation
- ## Remediation Suggestions 1. Bundle the CRM client implementation with the Skill so its complete behavior can be reviewed and versioned with the package. 2. Pin the client to an approved version and verify a cryptographic hash or digital signature before execution. 3. Avoid mutable absolute paths outside the package. Resolve the executable from a controlled, read-only installation directory. 4. Run the client under a dedicated, non-root service account with no unnecessary filesystem or system privileges. 5. Grant GHL and Habilis credentials only the minimum API scopes required for lead qualification and opportunity-stage updates. 6. Avoid broadly exporting credentials into the environment when possible. Use a scoped secret provider and ensure secrets are never logged. 7. Validate `OPP_ID` and `STAGE_ID` against strict expected formats and confirm that both belong to the configured GHL location before updating records. 8. Restrict outbound network access to documented API endpoints and log CRM mutations without recording credentials or sensitive message content. 9. Add integrity checks, dependency review, and automated tests covering authorization boundaries and identifier validation. 10. Document the client's expected network requests, required permissions, data retention behavior, and failure modes so the package's security claims can be independently verified.