T07 · Tool Hijacking and Spoofing
- Location
router-integration.sh:12- Finding
Unverified External Router Can Be Hijacked or Spoofed
- Content
View full analysis
Vulnerability Details
File Location:
router-integration.sh, lines 12–20
Vulnerability Type: External mutable tool execution without path or integrity validation
Risk Level: Mediumbash # Récupérer toute la question comme un seul argument QUESTION="$*" # Debug (optionnel) # echo "🔍 Question reçue: '$QUESTION'" # Exécuter le router avec la question entre quotes pour préserver les caractères spéciaux cd /Users/thibaut/clawd exec node auto-router.js "$QUESTION"Technical Analysis
The wrapper delegates its core functionality to
auto-router.js, which is not included in the audited project. It changes into the hard-coded, externally mutable directory/Users/thibaut/clawdand then executes the relative pathauto-router.jsthrough Node.js.The script neither verifies the router file's identity or integrity nor confirms that the
cdoperation succeeded. Two execution-resolution risks consequently exist:- Anyone able to create or replace
/Users/thibaut/clawd/auto-router.jscan determine the code that the wrapper executes. - If
cd /Users/thibaut/clawdfails, the shell continues because the command is not guarded. Node.js may then execute an unrelatedauto-router.jsfrom the invoking process's current working directory.
The complete user question is passed to the selected script. Although
"$QUESTION"is correctly shell-quoted and no direct shell command injection was identified, the unverified JavaScript program receives the prompt and executes with the invoking user's privileges.SKILL.mdalso references/Users/thibaut/clawd/auto-router.js, but that implementation is absent from the submitted package. Therefore, its network activity, API credential use, prompt handling, routing logic, and cost behavior could not be audited.Attack Path
External file replacement path:
- An attacker obtains write access to
/Users/thibaut/clawd, or otherwise causes a malicious ...[truncated 1819 chars]
- Anyone able to create or replace
- Remediation
View remediation
Remediation Suggestions
-
Bundle the reviewed
auto-router.jsimplementation inside the project rather than relying on an external absolute directory. -
Resolve the router relative to the wrapper's own verified location:
bash #!/bin/bash set -euo pipefail if [ "$#" -eq 0 ]; then printf '%s\n' "Usage: $0 'your question'" >&2 exit 1 fi SCRIPT_DIR="$(CDPATH= cd -- "$(dirname -- "$0")" && pwd)" ROUTER="$SCRIPT_DIR/auto-router.js" if [ ! -f "$ROUTER" ] || [ ! -r "$ROUTER" ]; then printf 'Router unavailable: %s\n' "$ROUTER" >&2 exit 1 fi exec node -- "$ROUTER" "$*" -
If an external router is operationally required, use an absolute file path and abort explicitly if either the directory change or file validation fails.
-
Restrict write permissions on the router and its parent directory to a trusted administrative account.
-
Where feasible, verify the router against an approved cryptographic digest or signed release before execution.
-
Audit and package the missing JavaScript implementation so its network destinations, credential access, model-routing rules, and prompt-retention behavior can be reviewed.
-
Clearly disclose when prompts may be sent to paid or remote APIs, and obtain appropriate user consent before transmitting potentially sensitive content.
-