T07 · Tool Hijacking and Spoofing
Error
- Location
- runtime.py:9
- Finding
- Hard-Coded External Module Path Enables Python Import Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `runtime.py`, lines 9–22 **Vulnerability Type**: Untrusted external module loading through Python search-path manipulation **Risk Level**: High ### Vulnerable Code ```python SKILL_SCRIPTS = Path("/Users/Abigale/.codex/skills/wechat-article-workflow/scripts").resolve() DEFAULT_THEME_NAME = "elegant-gold" DEFAULT_TEMPLATE_NAME = "default" if str(SKILL_SCRIPTS) not in sys.path: sys.path.insert(0, str(SKILL_SCRIPTS)) from wechat_html_renderer import ( # noqa: E402 apply_template, available_template_catalog, available_themes, load_theme, markdown_to_wechat_html, render_standalone_document, theme_to_dict, ) ``` ### Technical Analysis The runtime prepends a hard-coded, user-specific directory to `sys.path` and then imports `wechat_html_renderer` from the resulting search path. The imported module is not included in the audited project, version-pinned, or subject to any integrity check. Python executes a module's top-level code during import. Because the external directory is inserted at index zero, a `wechat_html_renderer.py` file placed there takes precedence over modules available through ordinary package paths. An attacker who can create or modify files in that directory could therefore cause arbitrary Python code to execute when the skill is loaded. This is classified as tool hijacking because the skill explicitly redirects a legitimate-looking renderer import to an externally controlled local location. The hard-coded path also makes the skill non-portable and creates inconsistent behavior between audited source code and deployed execution environments. ### Attack Path 1. The attacker obtains write access to `/Users/Abigale/.codex/skills/wechat-article-workflow/scripts`, or causes a crafted directory and module to exist at that path in the target environment. 2. The attacker creates or replaces `wechat_html_renderer.py` with a malicious module that exposes the expecte ...[truncated 1380 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the hard-coded absolute path and the `sys.path.insert(0, ...)` mutation. 2. Package `wechat_html_renderer` inside the reviewed skill or a normal Python package and use an explicit package-relative import. 3. Declare the renderer as a pinned dependency with hashes and install it only from an approved package source. 4. Ensure the renderer source is included in security reviews so deployed behavior matches the audited artifact. 5. If external module loading is operationally unavoidable: - Obtain the path from trusted administrator-controlled configuration rather than user content. - Resolve and validate the path against an explicit allowlist. - Require restrictive directory ownership and permissions. - Reject symbolic links and unexpected file ownership where applicable. - Verify the module against an approved cryptographic digest before loading it. - Avoid placing the directory ahead of trusted package locations. 6. Run the formatter under a least-privileged account with filesystem, process, network, environment-variable, and credential access restricted to what formatting requires. 7. Add deployment tests that fail if the renderer resolves outside the expected installed package location. ]]>