T07 · Tool Hijacking and Spoofing
- Location
SKILL.md:9- Finding
Execution of an Unverified Out-of-Package Validation Tool
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 9
Vulnerability Type:T07: Tool Hijacking and Spoofing
Risk Level: MediumVulnerable code snippet:
markdown Read `references/provider-selection.md` before choosing a source. Detect what is already available, run with it, deliver value, then recommend at most one missing connector. All normalized factual inputs must satisfy the Groundcrew evidence contract (`evidence_type: authority`). Locate the active skills root and run `<skills-root>/.groundcrew/groundcrew-doctor.py --evidence <record.json>` before using them in a conclusion.Technical Analysis
The skill directs the agent to discover an “active skills root” and execute
groundcrew-doctor.pyfrom that location. The executable is outside the audited package and is not present in the supplied project, so its provenance, integrity, and behavior cannot be verified from the reviewed files.The location-selection instruction is also ambiguous: it does not prescribe a trusted, immutable installation path, ownership checks, cryptographic verification, or an approved executable identity. Consequently, a file with the expected path and name can appear legitimate while containing attacker-controlled logic. If the agent executes it without integrity validation or owner approval, the trust placed in the tool name and location becomes a local tool-spoofing opportunity.
The
<record.json>argument may also refer to data controlled by a user or external source. Although no command-injection defect is established by the documentation alone, the validator must receive this value through a direct process argument rather than shell-string interpolation.Attack Path
- An attacker gains write access to a directory that the agent may identify as the active skills root, or compromises an existing installation containing that root.
- The attacker creates or replaces
.groundcrew/groundcrew-doctor.pywith a ...[truncated 1162 chars]
- Remediation
View remediation
Remediation Suggestions
- Bundle the validator in the reviewed skill package, or depend on a validator installed in a fixed, trusted, administrator-controlled location.
- Pin the validator to an approved version and verify a cryptographic signature or trusted SHA-256 digest before every execution.
- Resolve the executable with a canonical absolute path. Reject symlinks, unexpected ownership, group/world-writable files, and paths outside an explicit allowlist.
- Require explicit owner approval before executing an external validator that has not been reviewed with the skill.
- Execute the validator in a sandbox with the minimum required filesystem and network permissions. Do not expose unrelated secrets or connector credentials to the child process.
- Invoke the process using an argument array, such as passing
--evidenceand the record path as separate arguments. Do not construct or evaluate a shell command from user-controlled values. - Validate that the evidence path resolves to an expected regular file within an approved workspace and use
--or an equivalent end-of-options safeguard where supported. - Document the authoritative installation location, expected owner, version, hash, and failure behavior. If verification fails, stop without using the evidence in a conclusion.