T07 · Tool Hijacking and Spoofing
- Location
scripts/smyx_plant_growth_stage_detection_analysis.py:5- Finding
Shared Temporary-Directory Python Import Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
scripts/smyx_plant_growth_stage_detection_analysis.py, lines 5–7
Vulnerability Type: Python module search-path hijacking
Risk Level: HighVulnerable Code
python current_dir = os.path.dirname(os.path.abspath(__file__)) parent_dir = os.path.dirname(os.path.dirname(os.path.dirname(current_dir))) sys.path.insert(0, parent_dir)Technical Analysis
The entry point derives an import root by traversing three parent directories from its own location and inserts that directory at index zero of
sys.path. In the audited deployment layout, the script is located under:text /tmp/.../artifact/scripts/smyx_plant_growth_stage_detection_analysis.pyThe calculated
parent_diris therefore/tmp. Placing this shared, locally writable directory first in Python's module search path allows modules located there to take precedence during subsequent imports, including:python from skills.smyx_common.scripts.util import RequestUtil, OpenIdUtilA separate local user able to create files under
/tmpcould prepare a counterfeitskillspackage tree. When the victim invokes the documented Skill entry point, Python may import and execute the attacker's package initialization or module code in the victim process.This is an exploitable trust-boundary violation because code controlled by another local account can be resolved as trusted Skill code. No evidence indicates that the project author intentionally introduced this behavior, so the project verdict remains
suspicious, notmalicious.Attack Path
- The project is installed or staged in the audited temporary-directory layout.
- A local attacker with write access to
/tmp, but without access to the victim account, creates a spoofed package such as/tmp/skills/__init__.pyand the required nested module structure. - The victim invokes the documented command:
bash python -m scripts.smyx_plant_growth_stage_detection_analysis
...[truncated 922 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the runtime
sys.pathmodification and execute the entry point through normal package resolution from the trusted project root. - Package and install the project using standard Python packaging mechanisms so imports do not depend on writable ancestor directories.
- If path bootstrapping is unavoidable:
- Derive the exact expected project root rather than traversing a fixed number of parents.
- Resolve and canonicalize the path with
os.path.realpath. - Verify that it contains expected project markers.
- Reject shared, temporary, or group/world-writable directories.
- Avoid placing the path before trusted package locations.
- Deploy the Skill beneath a directory owned by the executing account and not writable by other users.
- Add a regression test that runs the entry point from representative installation paths and verifies that all
skills.*modules resolve inside the trusted project directory.
- Remove the runtime