T07 · Tool Hijacking and Spoofing
Warning
- Location
- audio-models.md:29
- Finding
- Untrusted PATH Resolution for Undeclared Audio Model Runner<![CDATA[ ## Vulnerability Details **File Location**: `audio-models.md:29-33` **Vulnerability Type**: Unverified executable invocation through shell PATH resolution **Risk Level**: Medium ### Vulnerable Code ```bash run.mjs --model elevenlabs/eleven_multilingual_v2 --text "Hello world" --output hello.mp3 run.mjs --model openai/whisper-1 --file recording.m4a run.mjs --model replicate/meta/musicgen --prompt "upbeat electronic" --duration 30 --output track.mp3 ``` ### Technical Analysis The documentation instructs an agent with Bash access to invoke `run.mjs` as a bare command. The project does not contain this executable and does not identify a trusted installation source, fixed filesystem location, pinned version, or expected integrity hash. A shell resolves a bare command by searching directories listed in `PATH`. Consequently, an unrelated or attacker-controlled executable named `run.mjs` can be selected instead of the intended model runner. The examples also encourage passing local audio filenames to this unverified executable, increasing the potential confidentiality impact. ### Attack Path 1. An attacker places a malicious executable named `run.mjs` in a directory that appears early in the agent's `PATH`. 2. A user requests an audio generation or transcription operation described by the skill. 3. The agent follows the documented example and invokes `run.mjs`. 4. The shell resolves the command to the attacker-controlled executable. 5. The executable runs with the same operating-system identity and permissions as the agent and can access command arguments, referenced audio files, environment variables, and other resources available to that identity. ### Impact Assessment Successful exploitation permits arbitrary code execution with the agent process's privileges. The scope is limited by the agent's operating-system permissions and sandbox, but may include reading or modifying accessible files, obtaining environment variables such as API credentials, ...[truncated 87 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Bundle the intended runner with the skill and invoke it using a fixed project-relative or validated absolute path. - Do not rely on ambient `PATH` resolution for skill-owned executables. - Document the runner's trusted source and pin its version and cryptographic digest. - Verify the runner's integrity before execution. - Restrict its environment and filesystem access to the minimum required for the selected operation. - Require explicit user approval before sending local audio or other sensitive files to an external service. ]]>