T09 · Insecure Skill Coding Practices
- Location
scripts/smyx_separation_anxiety_relief_analysis.py:5- Finding
Python Module Hijacking Through a World-Writable Import Search Path
- Content
View full analysis
Vulnerability Details
File Location:
scripts/smyx_separation_anxiety_relief_analysis.py, lines 5–7
Vulnerability Type: Python import-path hijacking through a shared temporary directory
Risk Level: MediumVulnerable Code
python current_dir = os.path.dirname(os.path.abspath(__file__)) parent_dir = os.path.dirname(os.path.dirname(os.path.dirname(current_dir))) sys.path.insert(0, parent_dir) import argparse import json import mimetypes import traceback from datetime import datetime import requests import sys import os from .config import * from .skill import skill from skills.smyx_common.scripts.util import RequestUtil, OpenIdUtilTechnical Analysis
The entry point derives an import root by traversing three directories upward from its own directory and inserts the result at index zero of
sys.path.Under the audited deployment path:
text /tmp/clawhub-codex-scan-v57b9p8fznzbfksjfz7et1f3y18g4pzg-QapSUy/artifact/scripts/the traversal resolves as follows:
text scripts -> artifact -> clawhub-codex-scan-... -> /tmpConsequently,
/tmpis placed at the highest import priority. The subsequent import ofskills.smyx_common.scripts.util, including imports reached through.skill, may therefore resolve against an attacker-created/tmp/skillspackage rather than the package included in the project.On a typical multi-user system,
/tmpis writable by unprivileged local users. Python executes top-level module code during import, so resolving an attacker-controlled package from this directory results in arbitrary Python code execution before the Skill begins its intended analysis operation.This is an exploitable coding flaw rather than evidence that the project author intentionally included malicious code.
Attack Path
- The Skill is installed or executed from the audited directory structure beneath
/tmp. - A separate, low-privileg ...[truncated 1918 chars]
- The Skill is installed or executed from the audited directory structure beneath
- Remediation
View remediation
Remediation Suggestions
-
Remove the three-level traversal and never insert
/tmpor another shared writable directory intosys.path. -
If source-tree execution must be supported, calculate the actual project root directly from the entry point:
python current_dir = os.path.dirname(os.path.abspath(__file__)) project_root = os.path.dirname(current_dir) if project_root not in sys.path: sys.path.insert(0, project_root) -
Prefer installing the project as a Python package and using package-relative imports rather than modifying
sys.pathat runtime. -
Before adding any dynamically calculated import root, resolve it with
os.path.realpath()and verify that:- It is the expected project directory.
- It is owned by the expected account.
- It is not writable by other users.
- It does not traverse through an attacker-controlled symbolic link.
-
Run the Skill from a private, access-controlled installation directory rather than directly beneath a shared temporary directory.
-
Add a regression test that evaluates the calculated import root for representative installation paths and rejects shared temporary directories such as
/tmp.
-