T09 · Insecure Skill Coding Practices
- Location
templates/attack-engine-kit.md:181- Finding
Python Harness Executes Target Module Before Applying Process Isolation and Timeout
- Content
View full analysis
Vulnerability Details
File Location:
templates/attack-engine-kit.md, lines 181–186, 211–242, and 351–352
Vulnerability Type: Uncontained execution of target module initialization code
Risk Level: HighVulnerable Code
python def load_target(module_path: str, function_name: str): """Dynamically load a function from a file path.""" path = Path(module_path).resolve() spec = importlib.util.spec_from_file_location("target_module", path) module = importlib.util.module_from_spec(spec) spec.loader.exec_module(module) return getattr(module, function_name)python def run_single_attack(target_func, attack, timeout): """Run one attack vector with timeout + semantic validation.""" # ... def _execute(conn): try: start = time.monotonic() ret = target_func(*args, **kwargs) elapsed = (time.monotonic() - start) * 1000 conn.send(("ok", ret, elapsed)) except Exception as e: elapsed = (time.monotonic() - start) * 1000 conn.send(("exception", f"{type(e).__name__}: {e}", elapsed)) parent_conn, child_conn = multiprocessing.Pipe() proc = multiprocessing.Process(target=_execute, args=(child_conn,)) proc.start() proc.join(timeout=timeout)python target_path = resolve_target_path(args.config, config["target_module"]) target_func = load_target(str(target_path), config["target_function"])Technical Analysis
The harness resolves the target to a file under the attack configuration directory, but then imports that target in the parent harness process through
spec.loader.exec_module(module). Python module import executes all top-level statements in the selected file.The target is therefore executed before
run_single_attack()creates the timeout-controlled child process. The timeout protects only the subsequent target-function invocation; it does not protect module initialization.A malicious or com ...[truncated 2716 chars]
- Remediation
View remediation
Remediation Suggestions
- Move both module import and function invocation into the isolated child process. The parent process should pass only the validated target path, function name, arguments, and test metadata to the child.
- Start the timeout before module loading and apply it to the child's entire lifecycle, including interpreter startup, import, initialization, and function execution.
- Run the child in a disposable operating-system sandbox or container with:
- A non-privileged user.
- A read-only copy of the target workspace.
- A dedicated temporary writable directory.
- No access to home, SSH, cloud credential, or other sensitive directories.
- Sensitive environment variables removed.
- Network access disabled by default.
- CPU, memory, process-count, and file-size limits.
- Fail closed when the required isolation cannot be established. Do not treat ordinary multiprocessing as a security boundary.
- Prevent background-process escape by using a dedicated process group, namespace, container, or job object and terminating the entire group after each test.
- Resolve and validate symlinks immediately before the child opens the target. Where supported, use race-resistant file opening and mount the approved workspace as the only readable source tree.
- Write output reports only beneath an explicitly approved directory and validate output paths similarly to target paths.
- Clearly state in the generated harness output whether strong sandboxing is active, rather than describing process separation alone as isolation.