T07 · Tool Hijacking and Spoofing
Warning
- Location
SKILL.md:7- Finding
Execution of an Unbundled Validator from a Discoverable Local Path
- Content
View full analysis
/.groundcrew/groundcrew-doctor.py --evidence ` before using them in a conclusion. ``` The execution requirement is repeated in `references/connectors.md:73`: ```markdown - Run `groundcrew-doctor.py --evidence ` before a number appears in a conclusion. ``` ### Technical Analysis The Skill instructs the Agent to discover an “active skills root” and execute `groundcrew-doctor.py` from that location. The validator is not included in the audited package, and the instructions do not require verification of its version, cryptographic hash, signature, ownership, permissions, or provenance. This creates a local tool-hijacking boundary: the legitimate-looking validator command may execute code controlled by another party if the discovered skills root or `.groundcrew/groundcrew-doctor.py` is writable or has been replaced. Because the external script was not supplied, its behavior and integrity could not be audited. The issue is not evidence that the current validator is malicious. The vulnerability is that the Skill mandates execution without establishing that the selected executable is trusted and immutable. ### Attack Path 1. An attacker obtains write access to a directory that may be selected as the active skills root, or compromises an installation/update process controlling that directory. 2. The attacker creates or replaces `.groundcrew/groundcrew-doctor.py` with a malicious Python program. 3. A user ...[truncated 1261 chars]- Remediation
View remediation