T07 · Tool Hijacking and Spoofing
Error
- Location
SKILL.md:123- Finding
Execution of an Untrusted Binary from Predictable Shared Temporary Storage
- Content
View full analysis
/dev/null && echo "BACKGROUND_SCREENSHOT=true" || echo "BACKGROUND_SCREENSHOT=false" ``` ```bash # Compile the helper once per session (if not already compiled) if [ ! -f /tmp/safari_wid ]; then cat > /tmp/safari_wid.swift << 'SWIFT' import CoreGraphics import Foundation let options: CGWindowListOption = [.optionOnScreenOnly, .excludeDesktopElements] guard let windowList = CGWindowListCopyWindowInfo(options, kCGNullWindowID) as? [[String: Any]] else { exit(1) } for window in windowList { guard let owner = window[kCGWindowOwnerName as String] as? String, owner == "Safari", let layer = window[kCGWindowLayer as String] as? Int, layer == 0, let wid = window[kCGWindowNumber as String] as? Int else { continue } print(wid) exit(0) } exit(1) SWIFT swiftc /tmp/safari_wid.swift -o /tmp/safari_wid fi # Capture Safari window in background (no activation needed) WID=$(/tmp/safari_wid) screencapture -l "$WID" -o -x /tmp/safari_screenshot.png ``` ### Technical Analysis The Skill uses fixed paths in the system-wide temporary directory and executes `/tmp/safari_wid` before establishing that it was created by the current Skill invocation. The later existence check only verifies that the path is a regular file; it does not verify ownership, permissions, provenance, integrity, or whether the path was safely created. Because `/tmp` is shared and the filename is predictable, another local process or user can pre-create or replace `/tmp/safari_wid`. The initial capability test then executes the attacker-controlled file immediately. The subsequent compilation block also trusts an already existing file and skips rebuilding i ...[truncated 1831 chars]- Remediation
View remediation