T07 · Tool Hijacking and Spoofing
Error
- Location
- SKILL.md:123
- Finding
- Execution of an Untrusted Binary from Predictable Shared Temporary Storage<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 123-152 **Vulnerability Type**: Unsafe temporary-file handling and local tool spoofing **Risk Level**: High ### Vulnerable Code ```bash # Test if Screen Recording permission is granted (background screenshot available) /tmp/safari_wid 2>/dev/null && echo "BACKGROUND_SCREENSHOT=true" || echo "BACKGROUND_SCREENSHOT=false" ``` ```bash # Compile the helper once per session (if not already compiled) if [ ! -f /tmp/safari_wid ]; then cat > /tmp/safari_wid.swift << 'SWIFT' import CoreGraphics import Foundation let options: CGWindowListOption = [.optionOnScreenOnly, .excludeDesktopElements] guard let windowList = CGWindowListCopyWindowInfo(options, kCGNullWindowID) as? [[String: Any]] else { exit(1) } for window in windowList { guard let owner = window[kCGWindowOwnerName as String] as? String, owner == "Safari", let layer = window[kCGWindowLayer as String] as? Int, layer == 0, let wid = window[kCGWindowNumber as String] as? Int else { continue } print(wid) exit(0) } exit(1) SWIFT swiftc /tmp/safari_wid.swift -o /tmp/safari_wid fi # Capture Safari window in background (no activation needed) WID=$(/tmp/safari_wid) screencapture -l "$WID" -o -x /tmp/safari_screenshot.png ``` ### Technical Analysis The Skill uses fixed paths in the system-wide temporary directory and executes `/tmp/safari_wid` before establishing that it was created by the current Skill invocation. The later existence check only verifies that the path is a regular file; it does not verify ownership, permissions, provenance, integrity, or whether the path was safely created. Because `/tmp` is shared and the filename is predictable, another local process or user can pre-create or replace `/tmp/safari_wid`. The initial capability test then executes the attacker-controlled file immediately. The subsequent compilation block also trusts an already existing file and skips rebuilding i ...[truncated 1831 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Create a private, per-invocation directory rather than using fixed paths: ```bash TMP_DIR=$(mktemp -d "${TMPDIR:-/tmp}/claude-safari.XXXXXX") || exit 1 chmod 700 "$TMP_DIR" trap 'rm -rf "$TMP_DIR"' EXIT INT TERM ``` 2. Place the Swift source, compiled helper, and screenshot inside that private directory: ```bash SRC="$TMP_DIR/safari_wid.swift" BIN="$TMP_DIR/safari_wid" SCREENSHOT="$TMP_DIR/safari_screenshot.png" ``` 3. Compile the helper during the current invocation and never execute a pre-existing binary from a shared path. 4. Check compilation success before execution: ```bash swiftc "$SRC" -o "$BIN" || exit 1 chmod 700 "$BIN" ``` 5. Verify that the temporary directory and helper are owned by the current user and are not symbolic links before use. 6. Apply restrictive permissions with `umask 077` so screenshots and generated files cannot be read by other local users. 7. Avoid a separate “execute to detect availability” step. Compile the trusted helper first, then execute only the binary created in the private directory. 8. Remove all temporary artifacts reliably through a cleanup trap, including on interruption or failure. ]]>