T08 · Insecure Dependencies
Warning
- Location
scripts/_wiki_api.py:22- Finding
Execution of Dependencies from a Shared, Mutable Cross-Skill Environment
- Content
View full analysis
Vulnerability Details
File Location:
scripts/_wiki_api.py:22-36,scripts/_tpbl_boxscore_scraper.py:14-38, andSKILL.md:272-278
Vulnerability Type: Cross-skill dependency loading and unsafe dependency isolation
Risk Level: MediumVulnerable Code
scripts/_wiki_api.py:22-36:python # Scrapling venv path (shared with the CPBL skill) SCRAPLING_VENV = '/home/ichen/.openclaw/workspace/skills/cpbl/.venv' def _get_stealthy_fetcher(): """Get Scrapling StealthyFetcher (requires the CPBL skill venv).""" import sys import os venv_lib = f'{SCRAPLING_VENV}/lib' for d in os.listdir(venv_lib): if d.startswith('python3.'): site_packages = f'{venv_lib}/{d}/site-packages' if os.path.isdir(site_packages) and site_packages not in sys.path: sys.path.insert(0, site_packages) break from scrapling.fetchers import StealthyFetcher return StealthyFetcherscripts/_tpbl_boxscore_scraper.py:14-38:python # Scrapling venv path (shared with the CPBL skill) SCRAPLING_VENV = '/home/ichen/.openclaw/workspace/skills/cpbl/.venv' TPBL_BOXSCORE_URL = 'https://tpbl.basketball/schedule/{game_id}/box-score' def _debug_log(msg: str) -> None: """Write debug output when BASKETBALL_DEBUG=1.""" import os if os.environ.get('BASKETBALL_DEBUG', '').lower() in ('1', 'true', 'yes'): import sys print(f'[DEBUG] {msg}', file=sys.stderr) def _get_stealthy_fetcher(): """Get Scrapling StealthyFetcher (requires the CPBL skill venv).""" import sys import os venv_lib = f'{SCRAPLING_VENV}/lib' for d in os.listdir(venv_lib): if d.startswith('python3.'): site_packages = f'{venv_lib}/{d}/site-packages' if os.path.isdir(site_packages) and site_packages not in sys.path: sys.path.insert(0, site_packages) ...[truncated 2901 chars]- Remediation
View remediation
Remediation Suggestions
- Declare Scrapling as a dependency of this Skill and install it in this Skill's own isolated virtual environment.
- Remove the hard-coded
/home/ichen/...path and all manual insertion of externalsite-packagespaths intosys.path. - Pin direct and transitive dependency versions with a reviewed lockfile and integrity hashes where supported.
- Install browser artifacts through a reproducible setup process tied to reviewed versions rather than modifying another Skill's environment with
--force. - Ensure the Skill environment and installed packages are not writable by less-trusted users or unrelated Skills.
- If sharing is unavoidable, expose the scraper through a narrowly scoped service interface rather than importing executable code from another Skill's environment.
- Add startup validation that confirms the resolved module path belongs to the expected isolated environment.