T08 · Insecure Dependencies
Warning
- Location
- icp_modeler.py:410
- Finding
- Dynamic Execution of an Undeclared External Python Module<![CDATA[ ## Vulnerability Details **File Location**: `icp_modeler.py`, lines 410–425 **Vulnerability Type**: Unsafe dynamic dependency loading from mutable search paths **Risk Level**: Medium ### Vulnerable Code ```python try: sys.path.insert(0, os.path.dirname(__file__)) from generate import complete except ImportError: # generate.py is in the openclaw-skills parent dir gen_path = os.path.join( os.path.dirname(__file__), "..", "..", "..", "tier1-implementations", "openclaw-skills" ) sys.path.insert(0, os.path.abspath(gen_path)) try: from generate import complete except ImportError: return "[generate.py not found — set LLM_BACKEND=haiku and ensure generate.py is in path]" ``` ### Technical Analysis The premium content-generation path imports a module named `generate` after modifying `sys.path`. The project does not include `generate.py`, and the module is not a declared or pinned package dependency. If the first import fails, the code adds a hard-coded directory outside the audited project to the beginning of Python's module search path and attempts the import again. Python executes module-level code immediately during import. Consequently, invoking `--generate-content` can execute arbitrary code contained in any attacker-controlled or compromised `generate.py` found at one of the searched locations. This creates a dependency substitution risk and prevents the premium execution path from being fully reviewed or reproduced using only the files in this project. The declared `anthropic` installation dependency does not provide this module, so it does not establish the origin or integrity of the code ultimately imported as `generate`. ### Attack Path 1. An attacker obtains write access to the skill directory or the external `tier1-implementations/openclaw-skills` directory referenced by the fallback. 2. The attacker creates or replaces `generate.py` with a module containing malicious top-leve ...[truncated 1137 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Package the content-generation backend inside the audited skill and use a package-relative import, rather than importing an unqualified module from modified search paths. 2. Remove the hard-coded fallback to a directory outside the project and avoid runtime `sys.path` modification. 3. If the backend must remain external, distribute it as a version-pinned dependency from a trusted package repository and lock its version and integrity hash. 4. Declare every required runtime component in the skill metadata so installation and review cover the complete execution path. 5. Verify the external component's origin and integrity before loading it, and ensure its installation directory is not writable by less-trusted users. 6. Run optional LLM integration with the minimum required filesystem, network, and environment access. Provide only the specific API credential needed for the operation. 7. Fail closed with a clear dependency error when the trusted backend is unavailable instead of searching mutable or unrelated directories. ]]>