T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/import_check.py:179
- Finding
- Audited Python Modules Execute In-Process Without Isolation<![CDATA[ ## Vulnerability Details **File Location**: `scripts/import_check.py:179-200` **Vulnerability Type**: Unsafe execution of untrusted project code **Risk Level**: High ### Vulnerable Code ```python # Try to import the base package first try: importlib.import_module(package_name) except ImportError as e: results.failed.append( ImportFailure( module=package_name, error=str(e), error_type=type(e).__name__, is_critical=True, ) ) return results for modname, _ispkg in walk_package_modules(package_name, exclude): # Check if excluded if any( f"{package_name}.{ex}." in modname or modname == f"{package_name}.{ex}" for ex in exclude ): results.skipped.append(modname) continue results.total += 1 try: importlib.import_module(modname) ``` The package is also imported while discovering modules: ```python def walk_package_modules( package_name: str, exclude: list[str] ) -> Iterator[tuple[str, bool]]: """Yield (module_name, is_pkg) for all modules in a package.""" try: pkg = importlib.import_module(package_name) except ImportError as e: logger.error(f"Cannot import base package {package_name}: {e}") return ``` ### Technical Analysis `importlib.import_module()` does not merely validate import declarations. It executes all module-level Python code, including package initializers, decorators, registration hooks, and other import-time behavior. The checker imports the audited package and every discovered submodule directly inside the auditor process. It applies no process isolation, filesystem restriction, network restriction, environment-variable filtering, timeout, or privilege reduction. Exception handling only catches failures after module code has already executed and does not prevent side effects. Consequently, an untrusted repository can use ordinary import-time code to execute arb ...[truncated 1648 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. **Do not import untrusted project modules in the main Agent process.** Prefer static analysis of Python source and import declarations whenever runtime initialization is not essential. 2. When runtime import verification is required, run it in a disposable sandbox or container with: - No inherited secrets or credential-related environment variables. - Outbound network access disabled by default. - A read-only project mount. - A separate temporary writable directory. - No access to the host home directory or sensitive sockets. - A low-privilege, non-root user. - CPU, memory, process, and execution-time limits. 3. Import each module in a separate subprocess so a timeout, crash, or process-state modification cannot compromise the main auditor. 4. Require explicit user approval before executing code from an untrusted repository and clearly disclose that Python imports execute initialization code. 5. Record and report blocked filesystem, process, and network activity as audit findings rather than permitting those operations. 6. Avoid importing the base package twice during discovery and checking. ]]>