T07 · Tool Hijacking and Spoofing
- Location
benchmarks/lui_conflict_50_cases/tools/run_benchmark.py:27- Finding
Benchmark Runner Executes a Hard-Coded External Script
- Content
View full analysis
Vulnerability Details
File Location:
benchmarks/lui_conflict_50_cases/tools/run_benchmark.py:27, 64-70
Vulnerability Type: Untrusted external tool execution
Risk Level: MediumVulnerable Code
python CHECKER = Path("/Users/wangzhilelelelele/.agents/skills/scheduled-task-conflict-checker/scripts/check_scheduled_task_conflicts.py")python completed = subprocess.run( [sys.executable, str(CHECKER), str(TEMP_INPUT), "--format", "json"], check=False, text=True, stdout=subprocess.PIPE, stderr=subprocess.PIPE, )Technical Analysis
The benchmark runner does not execute the checker included in the audited project. Instead, it launches a Python file from a fixed absolute path outside the project directory.
Because the external file is not part of the audited artifact, its integrity and behavior cannot be guaranteed. Any user or process able to create or replace the file at that location can cause the benchmark runner to execute arbitrary Python code. The argument-list form of
subprocess.runprevents shell metacharacter injection, but it does not mitigate execution of an untrusted script.This also undermines benchmark integrity: reported results may come from a stale, modified, or unrelated checker rather than the bundled implementation.
Attack Path
- An attacker obtains write access to the hard-coded
.agents/skillslocation, or prepares that location before the benchmark is run. - The attacker creates or replaces
check_scheduled_task_conflicts.pywith malicious Python code. - A user follows the documented validation procedure and runs
run_benchmark.py. - The runner invokes the external file through the current Python interpreter.
- The malicious code executes with the operating-system privileges and environment of the benchmark user.
Impact Assessment
Successful exploitation permits arbitrary code execution with the benchmark runner's user privileges. Depending on those privileges ...[truncated 417 chars]
- An attacker obtains write access to the hard-coded
- Remediation
View remediation
Remediation Suggestions
Resolve the checker from the project directory rather than an external user-specific location. For example:
python PROJECT_ROOT = ROOT.parents[1] CHECKER = PROJECT_ROOT / "scripts" / "check_scheduled_task_conflicts.py"Before execution:
- Resolve both paths using
Path.resolve(). - Verify that the checker is a regular file.
- Verify that the resolved checker remains beneath the expected project root.
- Fail closed if validation fails.
- Optionally verify a trusted file hash in release or CI environments.
- Remove the user-specific absolute path from the repository.
- Regenerate benchmark results using the bundled checker.
A hardened check could use:
python project_root = PROJECT_ROOT.resolve() checker = CHECKER.resolve(strict=True) if not checker.is_file() or not checker.is_relative_to(project_root): raise RuntimeError("Checker must be a regular file inside the project")- Resolve both paths using