T07 · Tool Hijacking and Spoofing
- Location
SKILL.md:7- Finding
Execution of an Unverified Out-of-Package Validation Tool
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 7
Vulnerability Type: T07: Tool Hijacking and Spoofing
Risk Level: HighVulnerable Code Snippet
markdown Read `references/provider-selection.md` before choosing a source. Detect what is already available, run with it, deliver value, then recommend at most one missing connector. All normalized factual inputs must satisfy the Groundcrew evidence contract. Locate the active skills root and run `<skills-root>/.groundcrew/groundcrew-doctor.py --evidence <record.json>` before using them in a conclusion. Output follows `references/reporting.md`: shared skeleton, SHIP/FIX/BLOCK/UNDECIDED verdict, Measured/User-provided/Estimated labels.Technical Analysis
The skill instructs the agent to discover an “active skills root” and execute
groundcrew-doctor.pyfrom that location. The executable is not included in the audited package, and the instruction does not require verification of its ownership, integrity, permissions, signature, or cryptographic digest.The security of this operation therefore depends on how the active root is resolved and who can modify it. If an attacker can influence root discovery or write to
<skills-root>/.groundcrew/, they can replace the expected validator with an attacker-controlled program. The resulting command would appear legitimate because it uses the documented filename and path layout, while actually invoking substituted code.This is a local tool-spoofing risk rather than confirmed embedded malware: the audited artifact contains no malicious script, but its documented execution procedure lacks a trust-boundary check.
Attack Path
- The attacker obtains write access to a candidate skills root or influences the mechanism used to select the active skills root.
- The attacker creates or replaces
<skills-root>/.groundcrew/groundcrew-doctor.pywith a malicious Python program. - A user invokes this keyword-report skill.
- The agent follows `S ...[truncated 1235 chars]
- Remediation
View remediation
Remediation Suggestions
- Bundle the validator inside the reviewed package, or install it through a trusted and version-pinned distribution mechanism.
- Resolve the validator from an explicit, immutable path rather than dynamically discovering an “active skills root.”
- Before execution, verify the validator against a pinned cryptographic digest or trusted digital signature.
- Reject the validator when its file, parent directory, or resolved root is writable by untrusted users or groups.
- Resolve symlinks and confirm that the canonical path remains within an approved directory.
- Execute the validator with a fixed interpreter and argument array rather than constructing a shell command.
- Run it in a sandbox with minimal filesystem access, no unnecessary credentials, and network egress disabled.
- Prefer a non-executable local schema validator when evidence validation does not require arbitrary program logic.
- Fail closed if the trusted validator is missing or fails integrity checks; do not search fallback paths.
- Document the approved validator version, source, expected digest, and trust assumptions directly in the skill package.