Python venv 修复与标准库补齐

• Outcome: Review
• Latest audit: Sep 15, 2026 · 1:00 PM UTC
• Version: 1.0.0

Overview

This skill is a coherent Python troubleshooting guide, but it asks users to make privileged, persistent system changes with limited safeguards.

Review carefully before installing or using. Treat the sudo copy into /usr/local as a system-wide change: confirm package provenance, full ABI compatibility, existing destination files, backups, and rollback steps first. For the venv rebuild path, verify the exact absolute path before any rm -rf command and prefer renaming the old venv to a backup before deleting it.

A.I.G

Vulnerability Patterns

• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions
• Remote Payload Retrieval and Execution: Fetches external code whose behavior can change after review

Findings (3)

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:43
• Finding: Unsafe Privileged Modification of a Shared Python Installation<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 43–49 **Vulnerability Type**: Unsafe privileged file replacement **Risk Level**: Medium ### Vulnerable Code ```bash # 3. 复制（cpython-311 后缀必须匹配目标 Python 小版本） sudo cp /usr/lib64/python3.11/lib-dynload/_sqlite3.cpython-311-x86_64-linux-gnu.so \ /usr/local/lib/python3.11/lib-dynload/ # 4. 验证 + 重启服务 <venv>/bin/python3 -c "import sqlite3; print(sqlite3.sqlite_version)" sudo systemctl restart <service> ``` ### Technical Analysis The instructions use root privileges to copy a native Python extension from an RPM-managed interpreter into a separately built, system-wide Python installation. Compatibility is assessed only through the Python minor version and filename suffix. The procedure does not verify: - The source file's package provenance or integrity. - The target interpreter's complete SOABI and build configuration. - Architecture and compiler compatibility beyond the hard-coded filename. - Linked native library compatibility. - Whether a destination file already exists and will be overwritten. - Destination ownership and permissions. - Whether other applications depend on the shared `/usr/local` interpreter. Native CPython extensions execute within the interpreter process and must match its ABI and linked-library expectations. A mismatch can produce import failures, interpreter crashes, memory corruption, or undefined behavior. Because the destination is shared rather than isolated to the virtual environment, the modification may affect multiple applications. ### Attack Path 1. An operator follows the documented repair procedure with `sudo`. 2. The source extension is incompatible, modified, or otherwise untrusted. 3. `sudo cp` places or overwrites `_sqlite3` in the shared `/usr/local` Python installation. 4. The verification command or restarted service imports `sqlite3`. 5. The interpreter loads the copied native extension into its process. 6. An incompatible module causes ...[truncated 686 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Prefer rebuilding Python with the required development libraries or recreating the virtual environment with the complete RPM-packaged interpreter. - Do not modify a shared interpreter until the repair has been tested in an isolated environment. - Verify the source package and file integrity using the package manager, such as `rpm -qf` and `rpm -V`. - Compare the complete SOABI using `sysconfig.get_config_var("SOABI")`, not only the Python minor version. - Validate architecture, build flags, and native dependencies with tools such as `file`, `readelf`, and `ldd`. - Refuse to overwrite an existing destination module without an explicit backup and operator confirmation. - Use `install` with explicit ownership and permission settings rather than an unrestricted `cp`. - Test imports and application behavior in a staging environment before restarting a production service. - Document a rollback procedure that restores the original module or interpreter installation. ]]>

T09 · Insecure Skill Coding Practices

Warning

• Location: SKILL.md:58
• Finding: Unvalidated Recursive Deletion of a User-Supplied Virtual Environment Path<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 58–63 **Vulnerability Type**: Unsafe destructive filesystem operation **Risk Level**: Medium ### Vulnerable Code ```bash 1. **重建 venv**（依赖要重装，耗时最长）： ```bash rm -rf <venv> /usr/bin/python3.11 -m venv <venv> # 用 rpm 版，自带全套标准库 <venv>/bin/pip install -r requirements.txt ``` ``` ### Technical Analysis The repair procedure recursively deletes the path substituted for `<venv>` without validating that it is a virtual environment. It does not canonicalize the path, reject empty or system-critical paths, check for expected virtual-environment markers, create a backup, or request confirmation. Although `<venv>` is presented as a placeholder rather than directly interpolated shell input, an operator can substitute an incorrect path. Shell expansion, environment variables, typographical errors, or copied automation can make `rm -rf` target unrelated files. ### Attack Path 1. An operator replaces `<venv>` with an incorrect, empty, overly broad, or attacker-influenced path. 2. The command is run with the operator's current privileges. 3. `rm -rf` recursively removes every accessible file beneath that path without confirmation. 4. Application files, configuration, user data, or system files are destroyed. 5. The subsequent environment recreation may conceal that the original directory contained unrelated data. ### Impact Assessment The command can delete any files writable by the invoking account. If executed by an administrator, the impact can extend to system files, application installations, service data, and configurations. The primary consequences are data loss and service unavailability; no privilege escalation is required for exploitation. ]]>
• Remediation: <![CDATA[ ## Remediation Suggestions - Resolve the target to a canonical absolute path before performing any destructive operation. - Reject empty paths, `/`, home directories, `/usr`, `/var`, and other protected or system-critical locations. - Verify expected virtual-environment markers such as `pyvenv.cfg` and `bin/python`. - Display the resolved path and require explicit operator confirmation. - Rename the environment to a timestamped backup instead of deleting it immediately. - Quote every path consistently to prevent word splitting and glob expansion. - Use a defensive removal script that fails closed when any validation is unsuccessful. - Preserve application configuration and dependency lockfiles outside the directory being replaced. ]]>

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:58
• Finding: Installation of Python Dependencies Without Integrity or Source Controls<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md`, lines 58–63 **Vulnerability Type**: Unverified third-party dependency installation **Risk Level**: Medium ### Vulnerable Code ```bash 1. **重建 venv**（依赖要重装，耗时最长）： ```bash rm -rf <venv> /usr/bin/python3.11 -m venv <venv> # 用 rpm 版，自带全套标准库 <venv>/bin/pip install -r requirements.txt ``` ``` ### Technical Analysis The instructions install all packages referenced by an unspecified `requirements.txt` without requiring exact version pins, cryptographic hashes, a trusted package index, or prior dependency review. Python package installation can execute build backend and installation-related code. Consequently, an attacker-controlled requirements file, dependency-confusion package, compromised package release, or unsafe package source can cause code execution during installation. The documentation does correctly use the virtual environment's `pip`, which limits installation scope, but a virtual environment does not sandbox package installation code from the invoking user's filesystem, credentials, network access, or processes. ### Attack Path 1. An attacker modifies `requirements.txt`, introduces a deceptive dependency name, or publishes a higher-priority package to a configured index. 2. The operator follows the repair instructions and runs the provided `pip install` command. 3. Pip resolves and downloads the attacker-controlled package. 4. The package's build or installation process executes arbitrary code. 5. That code accesses data and performs actions available to the invoking user. ### Impact Assessment A malicious dependency can execute code with the full privileges of the account running `pip`. Potential impact includes reading or modifying user-accessible files, accessing environment variables and credentials, making network requests, altering application code, and compromising the rebuilt environment. If the command is run as a privileged account, the impact expands a ...[truncated 121 chars]
• Remediation: <![CDATA[ ## Remediation Suggestions - Use a reviewed lockfile containing exact dependency versions. - Require cryptographic hashes with `pip install --require-hashes`. - Configure an explicitly trusted package index and disable unintended fallback indexes. - Review direct and transitive dependencies before deployment. - Run dependency vulnerability and provenance checks in CI. - Perform installation as a dedicated, non-privileged service account. - Build and test dependencies in an isolated environment before production deployment. - Prefer internally approved wheels or a controlled package repository for production services. ]]>

SkillSpector

Vulnerability Patterns

• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access
• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Supply Chain: Unpinned Dependencies, External Script Fetching, Obfuscated Code
• Excessive Agency: Unrestricted Tool Access, Autonomous Decision Making, Scope Creep

Findings (3)

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

ldconfig -p | grep sqlite    # 本例需要 libsqlite3.so.0

# 3. 复制（cpython-311 后缀必须匹配目标 Python 小版本）
sudo cp /usr/lib64/python3.11/lib-dynload/_sqlite3.cpython-311-x86_64-linux-gnu.so \
        /usr/local/lib/python3.11/lib-dynload/

# 4. 验证 + 重启服务

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Sudo/Root Execution

Medium

• Category: Privilege Escalation

Content

# 4. 验证 + 重启服务
<venv>/bin/python3 -c "import sqlite3; print(sqlite3.sqlite_version)"
sudo systemctl restart <service>
```

**注意：**

• Confidence: 70% confidence
• Finding: Commands invoke sudo or root privileges. Verify this elevated access is necessary and justified.

Missing User Warnings

Medium

• Confidence: 92% confidence
• Finding: The skill instructs users to run `rm -rf <venv>` to rebuild the environment, but it does not explicitly warn that this permanently deletes the virtual environment and anything stored inside it. In a troubleshooting skill, users may copy commands quickly under outage pressure, increasing the risk of accidental data loss if the path is wrong or the venv contains non-reproducible artifacts.

Static analysis

No suspicious patterns detected.