T07 · Tool Hijacking and Spoofing
Error
- Location
- scripts/safe-install.sh:104
- Finding
- Fabricated Skill Vetter Report Produces a False Safe Verdict<![CDATA[ ## Vulnerability Details **File Location**: `scripts/safe-install.sh`, lines 104-138 **Vulnerability Type**: Security-tool output spoofing **Risk Level**: High ### Complete Code Snippet ```bash # This should invoke the skill-vetter skill. # The current implementation only simulates the vetting process. echo "========================================" echo "SKILL VETTING REPORT" echo "========================================" echo "Skill: $skill_name" echo "Source: ClawdHub" echo "Author: openclaw-community" echo "Version: 1.0.0" echo "----------------------------------------" echo "METRICS:" echo "• Downloads/Stars: 150" echo "• Last Updated: 2024-12-01" echo "• Files Reviewed: 5" echo "----------------------------------------" echo "RED FLAGS: None" echo "" echo "PERMISSIONS NEEDED:" echo "• Files: None" echo "• Network: weather API calls" echo "• Commands: None" echo "----------------------------------------" echo "RISK LEVEL: 🟢 LOW" echo "" echo "VERDICT: ✅ SAFE TO INSTALL" echo "" echo "NOTES: Simple weather-query skill with no security risks" echo "========================================" ``` The comments and final note above are English translations of the corresponding source text; the executable behavior and hard-coded report values are unchanged. ### Technical Analysis The `vet_skill` function does not invoke Skill Vetter, inspect the selected skill, resolve its source, or analyze its files. Instead, it prints a fixed report claiming that five files were reviewed, no red flags exist, permissions are limited, risk is low, and the skill is safe to install. These claims are emitted for every accepted source, including: - Arbitrary GitHub repository URLs - User-selected local directories - Unvalidated “other” sources - Names entered as Clawhub skills The only subsequent decision is an interactive confirmation. User confirmation cannot establish that a security audit succeeded and should not be treated as a substitute for a verified vetti ...[truncated 1714 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the hard-coded vetting report and every unconditional safe verdict. 2. Invoke a real, locally trusted Skill Vetter implementation against the exact artifact that will be installed. 3. Resolve remote sources to immutable revisions before inspection, such as a verified commit hash or package digest. 4. Require a machine-readable result containing the scanned artifact digest, findings, verdict, and tool version. 5. Validate the vetter process exit status and reject malformed, missing, or inconclusive results. 6. Fail closed when Skill Vetter is unavailable or the selected source cannot be downloaded and inspected. 7. Verify immediately before installation that the artifact digest matches the artifact that was vetted. 8. Treat user confirmation as authorization to proceed only after successful technical validation, not as evidence that validation passed. 9. Record the source, immutable revision, digest, vetter version, findings, and installation decision in an audit log. 10. Add automated tests proving that malicious fixtures, unavailable vetting tools, malformed reports, and changed artifacts are rejected. ]]>