T07 · Tool Hijacking and Spoofing
Error
- Location
- valuation.py:9
- Finding
- User-Writable Python Import Path Enables Dependency Hijacking## Vulnerability Details **File Location**: `valuation.py`, lines 9–14 **Vulnerability Type**: Python module search-path hijacking **Risk Level**: High **Vulnerable Code**: ```python # Add workspace to path sys.path.insert(0, os.path.expanduser('~/.openclaw/workspace')) try: import yfinance as yf except ImportError: print("Error: yfinance not installed. Run: pip install yfinance") ``` ### Technical Analysis The program prepends `~/.openclaw/workspace` to `sys.path` before importing the third-party `yfinance` package. Python searches entries in `sys.path` in order, so a file named `yfinance.py` or a directory named `yfinance` within that workspace takes precedence over the legitimate installed dependency. The workspace is also used for ordinary user-managed data such as `holdings.md` and may be writable by the user, another Skill, or another process operating in the shared Agent workspace. No Python modules from this directory are required by the audited script, making the path modification unnecessary. An attacker with write access to the workspace can exploit this behavior without altering the audited project itself. Malicious top-level statements in a spoofed module execute immediately when the import occurs. ### Attack Path 1. The attacker gains the ability to create files in `~/.openclaw/workspace`, potentially through another Skill or process sharing that workspace. 2. The attacker creates `~/.openclaw/workspace/yfinance.py` or a malicious `yfinance/` package. 3. A user invokes `valuation.py`. 4. The script inserts the attacker-writable workspace at index zero of `sys.path`. 5. Python resolves `import yfinance as yf` to the attacker's module instead of the legitimate package. 6. The attacker's top-level Python code executes with the privileges and environment of the user running the Skill. ### Impact Assessment Successful exploitation provides arbitrary Python code execution under the Agent ...[truncated 479 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the workspace path modification because this script does not import any modules from the workspace: ```python try: import yfinance as yf except ImportError: print("Error: yfinance is not installed.") sys.exit(1) ``` 2. Continue accessing `holdings.md` through its explicit filesystem path rather than adding its parent directory to Python's module search path. 3. If local modules become necessary, package them with the project or place them in a dedicated trusted directory with restrictive ownership and permissions. 4. Do not prepend user-writable or shared data directories to `sys.path`. 5. Run the Skill with least privilege and restrict write access to directories containing executable Python modules. 6. Consider launching Python with isolated import settings where operationally appropriate, and verify that dependencies resolve from the expected environment.