T07 · Tool Hijacking and Spoofing
Error
- Location
- scripts/security_scanner.py:12
- Finding
- Unverified External Python Modules Can Be Loaded and Executed<![CDATA[ ## Vulnerability Details **File Location**: `scripts/security_scanner.py:12-15` **Vulnerability Type**: Python import-path manipulation and unverified external dependency loading **Risk Level**: High ### Vulnerable Code ```python # Add the OSA tool directory to path sys.path.insert(0, str(Path(__file__).parent.parent.parent / "openclaw-security-auditor")) from osa.scanner_fixed import SecurityScanner from osa.reporter import ReportGenerator ``` ### Technical Analysis The scanner prepends a predictable directory outside the audited project to `sys.path` and then imports the `osa.scanner_fixed` and `osa.reporter` modules. Those modules are not included in this project, pinned to a verified package version, or checked against trusted cryptographic hashes. Python executes module-level code when a module is imported. Consequently, a party that can create or modify the expected external `openclaw-security-auditor/osa` package can cause arbitrary Python code to execute when `security_scanner.py` is imported or run. Prepending the external path gives modules found there priority during import resolution. This crosses the audited package's trust boundary and prevents the effective scanner implementation from being verified as part of this audit. It also creates an opportunity to spoof legitimate-looking scanner and report-generator classes. The import is indirectly triggered by `test_skill.py:10-12`, which adds the local scripts directory to `sys.path` and imports `security_scanner`: ```python # Add skill scripts to path sys.path.insert(0, str(Path(__file__).parent / "scripts")) from security_scanner import scan_openclaw_config ``` ### Attack Path 1. An attacker obtains write access to the predictable external `openclaw-security-auditor` directory or causes an untrusted package to be installed there. 2. The attacker creates or modifies `osa/scanner_fixed.py`, `osa/reporter.py`, or package initialization files. 3. A user or Agent imports `scripts/sec ...[truncated 1166 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Remove the runtime `sys.path.insert` modification. 2. Bundle the required `osa` implementation inside the audited project and use package-relative imports, for example: ```python from .osa.scanner_fixed import SecurityScanner from .osa.reporter import ReportGenerator ``` 3. If `osa` must remain a third-party dependency: - Declare it through a standard dependency manifest. - Pin an exact trusted version. - Verify package hashes during installation. - Install it only from an authenticated, approved package repository. - Use a locked virtual environment rather than a writable sibling directory. 4. Validate that the imported module originates from the expected installed path before using it. 5. Fail closed with a clear error if the verified dependency is unavailable; do not search predictable external directories as a fallback. 6. Include the effective scanner and reporter implementations in future security-review scope. 7. Add a regression test that places a fake `osa` module in nearby directories and confirms that it cannot override the trusted implementation. ]]>