T07 · Tool Hijacking and Spoofing
Warning
- Location
- pack.py:1
- Finding
- External Module Execution Through a Hard-Coded Import Path## Vulnerability Details **File Location**: `pack.py`, lines 1-4 **Vulnerability Type**: Untrusted Python module resolution and execution **Risk Level**: Medium ```python import sys sys.path.insert(0, r'C:\Users\funky\.openclaw\workspace\skills\skill-creator\scripts') import package_skill package_skill.main() ``` ### Technical Analysis The script prepends a hard-coded, external workspace directory to Python's module search path. It then imports `package_skill` from that preferred location and immediately invokes its `main()` function. Because `package_skill.py` is not included in the audited project, its behavior and integrity cannot be verified as part of this Skill. Python executes module-level code during import, meaning arbitrary code can run even before the explicit `package_skill.main()` call. If another party can create or replace the module in the referenced directory, the legitimate-looking packaging script becomes an execution channel for that party's code. ### Attack Path 1. An attacker obtains write access to: `C:\Users\funky\.openclaw\workspace\skills\skill-creator\scripts` 2. The attacker creates or replaces `package_skill.py` with a malicious implementation. 3. The user runs `pack.py`, believing it to be a benign packaging utility. 4. `sys.path.insert(0, ...)` gives the external directory precedence during module resolution. 5. Python imports the attacker-controlled module and executes its top-level statements. 6. The script subsequently calls the attacker's `main()` function. ### Impact Assessment Successful exploitation permits arbitrary Python code execution with the same operating-system privileges as the user running `pack.py`. The resulting scope can include reading or modifying files available to that account, accessing process environment data, launching child processes, and performing other actions allowed by the user's permissions. Exploitation requires write access to the hard-co ...[truncated 199 chars]
- Remediation
- ## Remediation Suggestions - Remove the hard-coded external directory insertion from `sys.path`. - Bundle the packaging implementation within the project and import it through an explicit project-relative package path. - Prefer a direct entry point whose implementation is included in the reviewed artifact. - If an external component is unavoidable, load it from a trusted, administrator-controlled location and verify its cryptographic hash or signature before execution. - Restrict write permissions on any directory containing executable Python modules. - Avoid executing substantive behavior automatically at import time. - Add an explicit `if __name__ == "__main__":` entry-point guard and invoke only a locally verified implementation.