提交 #852944: Sipeed PicoClaw <= 0.2.9 Time-of-check Time-of-use Race Condition (CWE-367)

# Technical Details
A TOCTOU race condition exists in the `exec` approval workflow in `pkg/agent/pipeline_execute.go`, `pkg/agent/hooks.go`, and `pkg/tools/shell.go` of PicoClaw.

The application fails to bind the directory identity reviewed by approval hooks to the directory ultimately used for command execution. Approval receives a raw mutable `cwd` string, while `ExecTool.executeRun()` later re-resolves symlinks immediately before launching the process.

# Vulnerable Code
File: `pkg/agent/pipeline_execute.go`
Method: tool approval request construction
Why: Passes raw `toolArgs`, including `cwd`, to approval hooks.

File: `pkg/agent/hooks.go`
Method: `ToolApprovalRequest`
Why: Stores `Arguments map[string]any`, so approval policies reason about an unbound path string.

File: `pkg/tools/shell.go`
Method: `ExecTool.executeRun`
Why: Calls `filepath.EvalSymlinks(cwd)` after approval and before `runSync`, allowing a symlink target swap to change the execution directory.

# Reproduction
1. Configure PicoClaw with hooks enabled and the `exec` tool enabled.
2. Create a workspace-local symlink `cwd-link` initially pointing to a safe directory.
3. Trigger an `exec` tool call using `cwd-link` and pause while approval is pending.
4. Retarget `cwd-link` to another workspace directory before execution resumes.
5. Observe approval saw the safe directory, but execution runs in the attacker-selected directory.

# Impact
- Breaks approval integrity for directory-sensitive command execution.
- Allows relative reads, writes, and command behavior to differ from what was approved.
- Undermines deployments that rely on approval hooks as a safety boundary for `exec`.

• 来源: ⚠️ https://github.com/sipeed/picoclaw/issues/3081
• 用户: Eric-i (UID 97584)
• 提交: 2026-06-09 13時29分 (1 月前)
• 管理: 2026-07-17 15時50分 (1 month later)
• 状态: 已接受
• VulDB条目: 379794 [Sipeed PicoClaw 直到 0.2.9 pipeline_execute.go ExecTool.executeRun cwe 竞争条件]
• 积分: 20