T09 · Insecure Skill Coding Practices
- Location
run.py:24- Finding
Untrusted Parent Directory Precedence Enables Python Module Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
run.py:24-25
Vulnerability Type: Python import-path manipulation and local module hijacking
Risk Level: MediumVulnerable Code
python # Ensure project root is on sys.path PROJECT_ROOT = Path(__file__).resolve().parent.parent sys.path.insert(0, str(PROJECT_ROOT))Technical Analysis
The script calculates
PROJECT_ROOTas the parent of the skill package directory and inserts that directory at index zero ofsys.path. This gives modules located in the parent project directory precedence during subsequent imports.The
run()function later imports security-sensitive modules such asagents.planner_agent,agents.visualizer_agent, andutils.config. Because the added path is searched first, a malicious or unintended package with one of these names in the parent directory can execute code during import.This is a local module-hijacking weakness rather than evidence that the reviewed package itself contains a malicious payload. Exploitation requires an attacker or another untrusted component to be able to create or replace modules in the parent project directory before this skill is invoked.
Attack Path
- An attacker obtains write access to the directory represented by
Path(__file__).resolve().parent.parent, or influences content extracted or installed into that directory. - The attacker creates a matching package or module, such as
agents/planner_agent.pyorutils/config.py. - A user invokes
run.py. - Lines 24-25 place the attacker-influenced parent directory at the beginning of Python's module search path.
- When
run()performs its late imports, Python resolves the attacker's module. - Top-level code in that module executes with the same operating-system identity, environment variables, filesystem access, and network permissions as the skill process.
Impact Assessment
Successful exploitation permits arbitrary Python ...[truncated 521 chars]
- An attacker obtains write access to the directory represented by
- Remediation
View remediation
Remediation Suggestions
- Do not prepend a broad parent directory to
sys.path. - Package the required application modules as an installable Python distribution and use explicit package imports.
- If path initialization is unavoidable, resolve and validate the expected repository root, restrict it to a trusted immutable location, and append it only when necessary rather than assigning it highest precedence.
- Run the skill from a virtual environment containing pinned, trusted dependencies.
- Ensure the repository root and all imported package directories are not writable by less-privileged or unrelated users.
- Validate deployment archives so unexpected top-level
agents,utils, or similarly named modules cannot be introduced. - Consider invoking the entry point as a package module, such as
python -m trusted_package.run, to obtain deterministic package-relative import behavior.
- Do not prepend a broad parent directory to