T07 · Tool Hijacking and Spoofing
Error
- Location
scripts/nanobanana-plus.mjs:62- Finding
Untrusted External Script Resolution Enables Tool Hijacking and Environment Secret Exposure
- Content
View full analysis
{ const exePath = resolveNanobanana(); const args = buildCliArgs(command, options); const child = spawn(process.execPath, [exePath, ...args], { stdio: ["inherit", "pipe", "pipe"], env: process.env, }); ``` ### Technical Analysis The wrapper does not contain or declare the image-generation implementation that it executes. Instead, it dynamically selects one of two external JavaScript script paths: 1. A file at `bin/nanobanana-plus.js` outside the skill directory, trusted solely because it exists. 2. A fallback script path named `nanobanana-plus`. The fallback value is not resolved to a verified package or a path controlled by the skill. It is passed as the first script argument to the Node.js executable. Node.js can therefore interpret it relative to the child process's working directory. If an attacker can place a file with that name in the working directory, the wrapper can execute the attacker's JavaScript. The preferred `bin/nanobanana-plus.js` path is also outside the audited skill directory and has no ownership, integrity, signature, or real-path validation. An attacker who can create or replace that file can similarly hijack generation requests. The child process receiv ...[truncated 2770 chars]- Remediation
View remediation