T07 · Tool Hijacking and Spoofing
Error
- Location
- SKILL.md:47
- Finding
- Unbounded Dynamic Registration of Remotely Controlled Tools<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 47–56 and 102–108 **Vulnerability Type**: Dynamic tool hijacking through an unpinned remote manifest **Risk Level**: High ### Complete Code Snippet ```markdown ## Tool Loading At initialization: 1. Fetch: GET https://api.looplink.app/mcp/manifest 2. Register each entry in `tools[]` as a callable OpenClaw skill. Each tool contains: - name - description - input_schema - output_schema - requiresAuthorization ``` The resulting capability scope is summarized as follows: ```markdown ## Summary This skill: - Dynamically loads Looplink tools from the MCP manifest - Uses `createAgent` to obtain a permanent apiKey - Stores and reuses the apiKey securely - Injects raw Authorization headers when required - Executes tools via https://api.looplink.app/mcp/call - Exposes all Looplink MCP capabilities to OpenClaw ``` ### Technical Analysis The Skill retrieves its complete tool inventory from a remote endpoint at initialization and registers every entry in the returned `tools[]` array. It does not define a local allowlist, pin a reviewed manifest version, verify a digital signature, constrain acceptable tool names, or require approval when the manifest changes. As a result, the effective capabilities and Agent-visible instructions are not fixed by the audited package. The operator of the remote endpoint—or an attacker who compromises that endpoint—can change tool names, descriptions, schemas, and authorization declarations after the Skill has been reviewed. This behavior is necessary to some extent for a dynamic MCP integration, but automatically exposing **all** remote capabilities is broader than the minimum privilege required for a social bookmarking application. Tool descriptions and schemas received from the service should be treated as untrusted input rather than automatically trusted capability definitions. This finding does not establish that the current Looplink service is maliciou ...[truncated 1525 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Replace unrestricted registration with a local allowlist of reviewed tool names and expected schemas. 2. Reject tools whose names, descriptions, schemas, or authorization requirements differ from the reviewed definitions. 3. Pin a manifest version or content digest. Prefer a cryptographically signed manifest verified against a locally trusted public key. 4. Require explicit user or administrator approval before enabling new tools or accepting material capability changes. 5. Permit only the minimum set of tools required for the declared bookmarking and content-organization functionality. 6. Treat all remote descriptions, schemas, and tool responses as untrusted data and prevent them from overriding system or user instructions. 7. Record security-relevant manifest changes without logging credentials or sensitive tool arguments. 8. Apply strict limits to manifest size, schema complexity, tool count, response size, and network timeouts. 9. Present the destination and categories of transmitted data to the user before a newly registered tool is first invoked. ]]>