T08 · Insecure Dependencies
Warning
- Location
- scripts/get_stock_info.py:18
- Finding
- Execution of an Unverified External Workspace Script<![CDATA[ ## Vulnerability Details **File Location**: `scripts/get_stock_info.py`, lines 18–25 **Vulnerability Type**: Unverified external dependency execution **Risk Level**: Medium ### Vulnerable Code ```python # Try to find tavily script in workspace tavily_script = "/home/frank/.openclaw/workspace/skills/openclaw-tavily-search/scripts/tavily_search.py" result = subprocess.run( ["python3", tavily_script, "--query", query, "--max-results", "3", "--format", "brave"], capture_output=True, text=True, timeout=15 ) ``` ### Technical Analysis The stock information workflow executes a Python script located outside the audited skill package. The external Tavily script is referenced through a hardcoded workspace path and is executed without validating its ownership, permissions, version, or cryptographic integrity. Although `subprocess.run()` uses an argument list rather than a shell command—preventing direct shell metacharacter injection through `query`—the entire external Python file remains an executable trust boundary. Its contents can change independently after this skill has been reviewed or installed. This creates a supply-chain dependency on a mutable local component. The vulnerability is exploitable if an attacker can publish, replace, or modify the referenced `openclaw-tavily-search` skill or its `tavily_search.py` file. ### Attack Path 1. An attacker obtains the ability to modify or replace: `/home/frank/.openclaw/workspace/skills/openclaw-tavily-search/scripts/tavily_search.py`. 2. The attacker inserts arbitrary Python code into that script. 3. A user requests stock information through this skill. 4. `get_stock_info()` calls `get_company_news()`. 5. `get_company_news()` launches the modified script using the system Python interpreter. 6. The attacker's code executes with the same operating-system identity, environment access, filesystem permissions, and network access as the Agent process. The attack does not require shell-com ...[truncated 709 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Avoid executing mutable scripts from outside the audited package. Integrate the required news API functionality directly into this skill through a reviewed library or HTTP client. 2. If an external helper must be used, package it as a version-pinned dependency and verify its origin during installation. 3. Before execution, validate the helper's cryptographic hash against a trusted, immutable value. Fail closed if validation fails. 4. Verify that the script and its parent directories are owned by the expected account and are not writable by untrusted users. 5. Use a configured and validated path rather than a developer-specific hardcoded workspace path. 6. Run the helper under a restricted environment with minimal filesystem permissions, a controlled environment-variable set, and limited network access. 7. Preserve the argument-list form of `subprocess.run()`; do not convert the invocation to `shell=True`. ]]>