T07 · Tool Hijacking and Spoofing
Warning
- Location
- router-integration.sh:12
- Finding
- Unverified External Router Can Be Hijacked or Spoofed## Vulnerability Details **File Location**: `router-integration.sh`, lines 12–20 **Vulnerability Type**: External mutable tool execution without path or integrity validation **Risk Level**: Medium ```bash # Récupérer toute la question comme un seul argument QUESTION="$*" # Debug (optionnel) # echo "🔍 Question reçue: '$QUESTION'" # Exécuter le router avec la question entre quotes pour préserver les caractères spéciaux cd /Users/thibaut/clawd exec node auto-router.js "$QUESTION" ``` ### Technical Analysis The wrapper delegates its core functionality to `auto-router.js`, which is not included in the audited project. It changes into the hard-coded, externally mutable directory `/Users/thibaut/clawd` and then executes the relative path `auto-router.js` through Node.js. The script neither verifies the router file's identity or integrity nor confirms that the `cd` operation succeeded. Two execution-resolution risks consequently exist: 1. Anyone able to create or replace `/Users/thibaut/clawd/auto-router.js` can determine the code that the wrapper executes. 2. If `cd /Users/thibaut/clawd` fails, the shell continues because the command is not guarded. Node.js may then execute an unrelated `auto-router.js` from the invoking process's current working directory. The complete user question is passed to the selected script. Although `"$QUESTION"` is correctly shell-quoted and no direct shell command injection was identified, the unverified JavaScript program receives the prompt and executes with the invoking user's privileges. `SKILL.md` also references `/Users/thibaut/clawd/auto-router.js`, but that implementation is absent from the submitted package. Therefore, its network activity, API credential use, prompt handling, routing logic, and cost behavior could not be audited. ### Attack Path **External file replacement path:** 1. An attacker obtains write access to `/Users/thibaut/clawd`, or otherwise causes a malicious ...[truncated 1819 chars]
- Remediation
- ## Remediation Suggestions 1. Bundle the reviewed `auto-router.js` implementation inside the project rather than relying on an external absolute directory. 2. Resolve the router relative to the wrapper's own verified location: ```bash #!/bin/bash set -euo pipefail if [ "$#" -eq 0 ]; then printf '%s\n' "Usage: $0 'your question'" >&2 exit 1 fi SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)" ROUTER="$SCRIPT_DIR/auto-router.js" if [ ! -f "$ROUTER" ] || [ ! -r "$ROUTER" ]; then printf 'Router unavailable: %s\n' "$ROUTER" >&2 exit 1 fi exec node -- "$ROUTER" "$*" ``` 3. If an external router is operationally required, use an absolute file path and abort explicitly if either the directory change or file validation fails. 4. Restrict write permissions on the router and its parent directory to a trusted administrative account. 5. Where feasible, verify the router against an approved cryptographic digest or signed release before execution. 6. Audit and package the missing JavaScript implementation so its network destinations, credential access, model-routing rules, and prompt-retention behavior can be reviewed. 7. Clearly disclose when prompts may be sent to paid or remote APIs, and obtain appropriate user consent before transmitting potentially sensitive content.