T08 · Insecure Dependencies
- Location
main.py:18- Finding
Unpinned External Python Dependency Loaded Through a Hard-Coded Search Path
- Content
View full analysis
Vulnerability Details
File Location:
main.py, lines 18–19
Vulnerability Type:T08: Insecure Dependencies
Risk Level: MediumVulnerable Code
python # 导入参数收集器 sys.path.insert(0, "/home/admin/.openclaw/workspace/skills/cnc-quote-system") from cnc_quote_collector import CNCQuoteCollector, ConvergenceLevelTechnical Analysis
The application prepends a hard-coded directory outside the audited project to Python's module search path and then imports
cnc_quote_collectorfrom that location. Because the inserted directory receives the highest search priority, any module with that name at the specified path will be imported.The external component is not included in the audited project, and the code does not pin its version, verify its integrity, or validate the resolved module path. Python executes module-level code during import, so modification or replacement of
cnc_quote_collector.pywould provide a direct code-execution primitive whenmain.pyis loaded.This is a local supply-chain and module-resolution weakness. Exploitation requires the attacker to obtain write access to the referenced workspace directory or influence how it is provisioned.
Attack Path
- The attacker obtains write access to
/home/admin/.openclaw/workspace/skills/cnc-quote-system, such as through a compromised dependency installation or an incorrectly permissioned shared workspace. - The attacker creates or replaces
cnc_quote_collector.pywith a malicious module implementing the expected symbols. - The Agent loads or invokes
main.py. sys.path.insert(0, ...)gives the attacker-controlled directory the highest module-resolution priority.- Python imports the substituted module and executes its top-level code.
- The payload runs with the same operating-system identity and permissions as the Agent process.
Impact Assessment
Successful exploitation permits arbitrary Python execution within the Agent process. The resulting access is ...[truncated 468 chars]
- The attacker obtains write access to
- Remediation
View remediation
Remediation Suggestions
- Package
cnc_quote_collectorwithin the Skill and import it through an explicit package-relative import. - Remove the runtime
sys.pathmodification and use Python's standard dependency and package-resolution mechanisms. - If the collector must remain external, declare it as a managed dependency with an exact version and integrity-locked artifact.
- Verify the resolved module path and artifact hash before loading the dependency.
- Restrict write permissions on the dependency directory to trusted deployment identities; the Agent runtime account should not be able to modify its own dependencies.
- Deploy dependencies from an immutable, trusted build artifact rather than a mutable workspace directory.
- Add a startup check that fails closed when the dependency is missing, unexpectedly located, or fails integrity verification.
- Package