Dangerous chain: exec() wrapping compile
Critical
- Category
- Dangerous Code Execution
- Confidence
- 95% confidence
- Finding
The code dynamically executes Python source loaded from disk via exec(compile(...)). Although it applies some trust checks (fixed filenames, non-symlink, same UID, not group/world writable), those checks do not eliminate code-execution risk if an attacker can modify those files as the same user, poison the local checkout, or influence the skill package contents. In a worker-orchestration skill, executing helper modules from disk expands the trusted computing base and turns file integrity failure into arbitrary code execution inside the agent context.
- Content
python module = types.ModuleType(name) module.__file__ = str(path) sys.modules[name] = module exec(compile(raw, str(path), "exec"), module.__dict__) return module, {"path": str(path), "sha256": hashlib.sha256(raw).hexdigest()}