T07 · Tool Hijacking and Spoofing
- Location
SKILL.md:7- Finding
Execution of an Unverified External Validation Script
- Content
View full analysis
Vulnerability Details
File Location:
SKILL.md, line 7
Vulnerability Type:T07: Tool Hijacking and Spoofing
Risk Level: MediumVulnerable Code
markdown Read `references/provider-selection.md` before choosing a source. Detect what is already available, run with it, deliver value, then recommend at most one missing connector. All normalized factual inputs must satisfy the Groundcrew evidence contract. Locate the active skills root and run `<skills-root>/.groundcrew/groundcrew-doctor.py --evidence <record.json>` before using them in a conclusion.Technical Analysis
The Skill mandates locating and executing
groundcrew-doctor.pyfrom an external “active skills root.” That executable is not included in the audited project. The instruction does not define a fixed trusted root, pin the script to a verified version or cryptographic digest, validate its signature, or require safe file ownership and permissions.As a result, the code ultimately executed can differ from the content reviewed in this audit. If an attacker can create, replace, or redirect the discovered script—including through an attacker-controlled skills root or filesystem link—the legitimate-looking validation operation can invoke attacker-controlled Python code.
The project also references
references/provider-selection.md, but that file is absent. This is an integrity and completeness issue in source-selection behavior, although it is not independently treated as an exploitable vulnerability here.Attack Path
- An attacker gains write access to the active skills root, influences how that root is discovered, or redirects the expected path.
- The attacker creates or replaces
.groundcrew/groundcrew-doctor.pywith a malicious script. - A user invokes the standup Skill with an evidence record.
- Following the mandatory instruction in
SKILL.md, the Agent runs the substituted script. - The malicious script executes with the operating-system permissions a ...[truncated 971 chars]
- Remediation
View remediation
Remediation Suggestions
- Bundle the validator inside the reviewed Skill package and resolve it relative to a fixed, canonical package directory.
- If external distribution is unavoidable, pin the validator to an approved version and verify a cryptographic hash or trusted digital signature before every execution.
- Canonicalize the path and reject symbolic links, unexpected ownership, group/world-writable files, and roots outside an explicit allowlist.
- Execute the validator with least privilege in a sandbox that restricts filesystem access, subprocess creation, environment-variable access, and outbound networking.
- Pass evidence through a constrained interface rather than granting broad directory access, and avoid exposing connector secrets to the validator process.
- Fail closed when the validator is absent or fails integrity checks; do not discover and run an alternative executable automatically.
- Add the missing
references/provider-selection.mdfile or remove the requirement to read it so source-selection behavior is complete and reviewable.