T07 · Tool Hijacking and Spoofing
Warning
- Location
SKILL.md:7- Finding
Execution of an Unverified External Validator from a Non-Canonical Skills Root
- Content
View full analysis
/.groundcrew/groundcrew-doctor.py --evidence ` before using them in a conclusion. ``` ### Technical Analysis The skill directs the agent to locate an “active skills root” and execute the hidden script `.groundcrew/groundcrew-doctor.py` from that location. The referenced executable is not included in the audited package, and the instruction does not define a canonical resolution procedure or require verification of the script’s origin, integrity, ownership, or cryptographic digest. This creates a local tool trust-boundary weakness. If an attacker can influence which directory is selected as the active skills root, or can replace the validator within an existing root, the legitimate-looking validation command can invoke attacker-controlled code. Static review of this skill cannot establish what code will ultimately execute. The issue is classified as tool hijacking rather than embedded malicious code because the audited package contains no executable payload. Exploitation depends on substitution or manipulation of a separately installed local tool. ### Attack Path 1. An attacker gains the ability to create or modify a directory that may be resolved as the active skills root. This may occur through a compromised installation, unsafe directory discovery, or writable shared paths. 2. The attacker places a malicious executable at `.groundcrew/groundcrew-doctor.py`, or replaces the legitimate validator. 3. A user invokes the competitor-watch skill with an evidence re ...[truncated 1041 chars]- Remediation
View remediation