T07 · Tool Hijacking and Spoofing
Error
- Location
- SKILL.md:9
- Finding
- Untrusted Project-Local Agent Definitions Can Be Spawned Without Integrity Verification<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:9, 27-29, 41-50, 221-225` **Vulnerability Type**: Untrusted local agent loading and execution **Risk Level**: High ### Relevant Code Snippet The following is an English translation of the relevant Skill instructions: ```text Line 9: Spawn version notice (does not block spawning): first read the agents_version from .story-deployed in the project root. If it differs from agents_version: 30 (including a missing marker, missing or non-integer field, lower version, or higher version), continue checking file existence and spawn normally. Lines 27-29: - /story-review or /story-review full: preferably spawn all four agents. - /story-review lean: preferably spawn story-architect and consistency-checker. - /story-review solo: do not spawn agents. Lines 41-50: 4. Check core agent deployment status in the canonical directory for the current runtime: - Claude Code: .claude/agents/ - OpenCode: .opencode/agents/ - Codex: .codex/agents/ - Antigravity: .agents/agents/ - Required full-mode agents: story-architect, character-designer, narrative-writer, consistency-checker - For Codex agents, the file must be {agent}.toml, parse as TOML, contain name, description, and developer_instructions, and have a matching name. - If any required agent file is missing or malformed, do not spawn the missing or malformed agent; fall back to solo mode. Lines 221-225: Phase 2: Spawn Agents in Parallel Only spawn after Phase 0 when the effective mode remains full or lean. Do not spawn missing agents. ``` ### Technical Analysis The Skill treats project-local custom agent files as trusted once they satisfy basic path and metadata checks. These checks establish only that a file exists, parses successfully, and uses the expected agent name. They do not establish that the file came from a trusted deployment or that its instruction body is safe. In particular, a Codex agent definition is ...[truncated 3450 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Fail closed when deployment provenance is unavailable** - Change the version policy so a missing, malformed, or mismatched `.story-deployed` marker forces `solo` mode. - Do not spawn project-local agents merely because their files exist and parse correctly. 2. **Use a trusted manifest** - Ship a signed or otherwise trusted manifest containing the approved relative path, agent name, version, and cryptographic hash for every agent definition. - Calculate and compare each agent file’s hash before spawning it. - Reject files that are absent from the manifest or whose hashes differ. 3. **Validate complete agent contents** - Compare instruction bodies against trusted deployment artifacts rather than validating only metadata fields. - Reject additional executable hooks, unexpected tool declarations, unknown fields, or instructions that expand the reviewer’s scope. 4. **Separate trusted installed agents from repository-controlled agents** - Prefer agents installed in a protected, user-controlled Skill directory. - Do not automatically load agent definitions from an untrusted project checkout. - If project-local overrides are necessary, require explicit per-project trust approval. 5. **Require informed confirmation for unverified agents** - Display the exact agent file path, source, version, and verification status. - Require explicit user confirmation before spawning an agent whose provenance cannot be cryptographically established. - Do not treat a previously trusted agent name as approval for changed file contents. 6. **Apply least privilege to spawned reviewers** - Grant read access only to the specified review files and required references. - Disable shell, network, credential, and unrestricted filesystem tools unless essential. - Prevent reviewer agents from spawning further agents. - Keep project writes disabled during review except for narrowly defined, validated state ...[truncated 505 chars]