T07 · Tool Hijacking and Spoofing
Warning
- Location
scripts/bootstrap.py:52- Finding
Untrusted External Module Loading Outside the Skill Package Boundary
- Content
View full analysis
Path: """ 将 cloud 客户端目录加入 sys.path。 - ClawHub zip：scripts/ 内已有 yufluent_api.py（package-skill 注入） - Monorepo：回退 skills/_shared/ """ scripts_dir = Path(script_file).resolve().parent skills_shared = scripts_dir.parent.parent / "_shared" for candidate in (scripts_dir, skills_shared, _SHARED_DIR): if candidate.is_dir() and (candidate / "yufluent_api.py").is_file(): path = str(candidate) if path not in sys.path: sys.path.insert(0, path) return candidate raise ImportError( "cloud client not found: expected scripts/yufluent_api.py (ClawHub) " "or skills/_shared/yufluent_api.py (monorepo)" ) ``` The selected path is subsequently trusted by `scripts/run.py`: ```python from bootstrap import ensure_cloud_client_path ensure_cloud_client_path(__file__) from cloud_cli import print_run_meta, print_skill_output, read_text_arg from discover import DiscoverError, discover_candidates, resolve_search_query from yufluent_api import YufluentApiError, run_skill ``` ### Technical Analysis The audited package does not include `yufluent_api.py`. The bootstrap logic therefore permits the runtime to resolve this executable Python module from a sibling `_shared` directory outside the audited Skill package. The selected directory is inserted at the beginning of `sys.path`. The subsequent `from yufluent_api import ...` statement executes the module's top-level code and trusts its `run_skill` implementation. This creates a package-boundary violation: the effective cloud client, including its authentication, network destination, TLS behavior, and request handli ...[truncated 2418 chars]- Remediation
View remediation