T07 · Tool Hijacking and Spoofing
- Location
scripts/chain_entry.py:9- Finding
Untrusted Sibling-Directory Module Loading Enables Tool Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
scripts/chain_entry.py, lines 9–14; invocation sites at lines 231–232, 250, and 268
Vulnerability Type: Untrusted Python import-path manipulation
Risk Level: MediumVulnerable Code
python # === PharmaLab Dashboard Hook === sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), '..', '..', 'pharmaclaw-lab-ui', 'scripts')) try: from lab_hook import lab_update except ImportError: def lab_update(*a, **kw): passThe imported function is subsequently called with user-derived molecular data:
python lab_update("pharmacology", "analyzing", f"ADME profiling {canonical_smiles[:40]}...", smiles=canonical_smiles)python lab_update("pharmacology", "idle", "ADME profile complete")python lab_update("pharmacology", "error", f"Failed: {str(e)[:60]}")Technical Analysis
The script prepends an external sibling directory to
sys.path, giving that location priority during Python module resolution. It then importslab_hook, which is not included in the audited project and therefore cannot be authenticated or reviewed as part of this Skill.An attacker with write access to
../../pharmaclaw-lab-ui/scripts/can create or replacelab_hook.py. Python executes module-level code immediately during import, before the Skill processes its main workload. CatchingImportErrordoes not mitigate this issue because a planted module imports successfully.The imported
lab_updatefunction also receives canonicalized SMILES values and error details. A malicious replacement can capture this information, alter application behavior, perform network communication, or execute arbitrary actions available to the current process.Attack Path
- The attacker obtains write access to the external
pharmaclaw-lab-ui/scriptssibling directory. - The attacker creates or replaces
lab_hook.pywith malicious module-level code or a maliciouslab_updatefuncti ...[truncated 1072 chars]
- The attacker obtains write access to the external
- Remediation
View remediation
Remediation Suggestions
- Remove the dashboard hook and
sys.pathmutation if the integration is not essential. - Package
lab_hookas a reviewed, version-pinned dependency and import it through the normal package mechanism. - Do not add mutable external directories to the beginning of
sys.path. - If local loading is unavoidable, resolve the module from a fixed trusted path, verify its integrity against a pinned cryptographic hash or signature, and reject unexpected ownership or writable permissions.
- Run the Skill with a dedicated least-privileged account in a sandbox that restricts filesystem access, environment secrets, and outbound networking.
- Require explicit configuration or opt-in before sending molecular inputs to dashboard integrations.
- Avoid passing full canonicalized SMILES or detailed errors unless necessary; minimize or redact data supplied to the hook.
- Add a startup assertion or automated test confirming that
lab_hook.__file__resolves only to the approved package location.
- Remove the dashboard hook and