T09 · Insecure Skill Coding Practices
Error
- Location
scripts/import_check.py:179- Finding
Audited Python Modules Execute In-Process Without Isolation
- Content
View full analysis
Iterator[tuple[str, bool]]: """Yield (module_name, is_pkg) for all modules in a package.""" try: pkg = importlib.import_module(package_name) except ImportError as e: logger.error(f"Cannot import base package {package_name}: {e}") return ``` ### Technical Analysis `importlib.import_module()` does not merely validate import declarations. It executes all module-level Python code, including package initializers, decorators, registration hooks, and other import-time behavior. The checker imports the audited package and every discovered submodule directly inside the auditor process. It applies no process isolation, filesystem restriction, network restriction, environment-variable filtering, timeout, or privilege reduction. Exception handling only catches failures after module code has already executed and does not prevent side effects. Consequently, an untrusted repository can use ordinary import-time code to execute arb ...[truncated 1648 chars]- Remediation
View remediation