T07 · Tool Hijacking and Spoofing
- Location
pack.py:1- Finding
External Module Execution Through a Hard-Coded Import Path
- Content
View full analysis
Vulnerability Details
File Location:
pack.py, lines 1-4
Vulnerability Type: Untrusted Python module resolution and execution
Risk Level: Mediumpython import sys sys.path.insert(0, r'C:\Users\funky\.openclaw\workspace\skills\skill-creator\scripts') import package_skill package_skill.main()Technical Analysis
The script prepends a hard-coded, external workspace directory to Python's module search path. It then imports
package_skillfrom that preferred location and immediately invokes itsmain()function.Because
package_skill.pyis not included in the audited project, its behavior and integrity cannot be verified as part of this Skill. Python executes module-level code during import, meaning arbitrary code can run even before the explicitpackage_skill.main()call. If another party can create or replace the module in the referenced directory, the legitimate-looking packaging script becomes an execution channel for that party's code.Attack Path
- An attacker obtains write access to:
C:\Users\funky\.openclaw\workspace\skills\skill-creator\scripts - The attacker creates or replaces
package_skill.pywith a malicious implementation. - The user runs
pack.py, believing it to be a benign packaging utility. sys.path.insert(0, ...)gives the external directory precedence during module resolution.- Python imports the attacker-controlled module and executes its top-level statements.
- The script subsequently calls the attacker's
main()function.
Impact Assessment
Successful exploitation permits arbitrary Python code execution with the same operating-system privileges as the user running
pack.py. The resulting scope can include reading or modifying files available to that account, accessing process environment data, launching child processes, and performing other actions allowed by the user's permissions.Exploitation requires write access to the hard-co ...[truncated 199 chars]
- An attacker obtains write access to:
- Remediation
View remediation
Remediation Suggestions
- Remove the hard-coded external directory insertion from
sys.path. - Bundle the packaging implementation within the project and import it through an explicit project-relative package path.
- Prefer a direct entry point whose implementation is included in the reviewed artifact.
- If an external component is unavoidable, load it from a trusted, administrator-controlled location and verify its cryptographic hash or signature before execution.
- Restrict write permissions on any directory containing executable Python modules.
- Avoid executing substantive behavior automatically at import time.
- Add an explicit
if __name__ == "__main__":entry-point guard and invoke only a locally verified implementation.
- Remove the hard-coded external directory insertion from