T07 · Tool Hijacking and Spoofing
Error
- Location
- SKILL.md:148
- Finding
- Execution of Untrusted Project-Local Helper Scripts## Vulnerability Details **File Locations**: - `SKILL.md:148-157` - `references/utility-scripts.md:3` - `references/utility-scripts.md:47` - `references/utility-scripts.md:93` **Vulnerability Type**: Trusting and executing attacker-controlled local tools based solely on expected filenames **Risk Level**: High ### Vulnerable Code Snippets English translation of the relevant documentation in `SKILL.md:148-157`: ```markdown The project may contain the following helper scripts. If present, use them preferentially: ### analyze_bib.py - Function: Parse .bib files, detect duplicates, and analyze citation coverage - Invocation: `python analyze_bib.py` ### nameTranslate.py - Function: Replace hard-coded journal names in .bib files with IEEE standard macros - Invocation: `python nameTranslate.py` ``` English translation of the relevant instruction in `references/utility-scripts.md:3`: ```markdown When these scripts exist in the project, preferentially invoke them directly. If they do not exist, use the following logic to temporarily write equivalent code or process the data directly with the LLM. ``` The documented commands at `references/utility-scripts.md:47` and `references/utility-scripts.md:93` are: ```bash python analyze_bib.py ``` ```bash python nameTranslate.py ``` ### Technical Analysis The Skill instructs the agent to execute helper scripts found in the user's document project based only on the filenames `analyze_bib.py` and `nameTranslate.py`. It does not require the agent to inspect their complete contents, validate their provenance or integrity, obtain explicit approval, or execute them in a restricted sandbox. These scripts are not bundled in the audited Skill package. Consequently, their contents are controlled by whoever supplies the project being reviewed. Python executes top-level statements immediately, so a malicious file does not need to implement the advertised analysis func ...[truncated 2415 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the instruction to preferentially execute scripts merely because they have expected filenames. 2. Require the agent to read and audit the complete contents of every project-local script before considering execution. Reject scripts containing unrelated filesystem access, network access, subprocess invocation, dynamic evaluation, obfuscated content, or undeclared dependencies. 3. Present the exact command, script path, purpose, audit result, and expected file changes to the user, then require explicit approval before execution. 4. Prefer immutable helper scripts shipped as part of the reviewed Skill package rather than project-local implementations. Pin and verify their cryptographic hashes or signatures. 5. Resolve and validate the canonical script path before execution. Do not rely on the current working directory, `PATH`, aliases, wrappers, or filename-only lookup. 6. Execute approved scripts in a sandbox with: - Read-only access to input files by default. - Write access limited to a dedicated output directory. - No access to credentials, unrelated workspace files, or sensitive environment variables. - Network access disabled unless separately justified and approved. - Process, time, memory, and output limits. 7. Avoid executing scripts for operations that can be completed with existing constrained tools such as file reading, pattern matching, and deterministic in-memory analysis. 8. Remove `Bash` and other broad tools from `allowed-tools` if they are not essential. If Bash remains necessary, enforce command allowlisting and least-privilege execution. 9. Update `references/utility-scripts.md` so that it describes algorithms as non-executable reference material and explicitly prohibits running project-supplied implementations without verification and approval.