T09 · Insecure Skill Coding Practices
Warning
- Location
- chart_gen.py:13
- Finding
- Unsafe Python Import Path Enables Local Module Hijacking## Vulnerability Details **File Location**: `chart_gen.py`, lines 13–18 **Vulnerability Type**: Python import path hijacking **Risk Level**: Medium ### Vulnerable Code ```python import json # 使用 conda 环境中的 matplotlib sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), '../../..')) import matplotlib matplotlib.use('Agg') # 非交互式后端 import matplotlib.pyplot as plt ``` ### Technical Analysis The script prepends an ancestor directory to `sys.path` before importing `matplotlib`. Because index zero has the highest import precedence, Python searches this ancestor directory before trusted environment and site-package locations. If an attacker can write a counterfeit `matplotlib.py` file or `matplotlib/` package into that ancestor directory, Python may load it instead of the legitimate Matplotlib dependency. Top-level Python statements in the counterfeit module execute immediately during import. The vulnerable path is derived from the script location rather than from a verified, private package directory. In the audited deployment layout, traversing three parent levels reaches a directory outside the Skill root and may expose import resolution to files controlled by another local process or user. Exploitation therefore depends on the attacker having write access to that ancestor directory. ### Attack Path 1. The attacker obtains write access to the directory resolved by `../../..` relative to `chart_gen.py`. 2. The attacker creates a malicious `matplotlib.py` file or `matplotlib/` package in that directory. 3. A user or automated agent invokes `chart_gen.py` for legitimate chart generation. 4. The `sys.path.insert(0, ...)` call gives the attacker-controlled location precedence over the installed Python packages. 5. The subsequent `import matplotlib` loads the counterfeit module. 6. The attacker's top-level Python payload executes with the identity and permissions of the process running the Skill. ### Impact Assessment Successful exploi ...[truncated 524 chars]
- Remediation
- ## Remediation Suggestions 1. Remove the ancestor-directory insertion and rely on the configured Python environment: ```python import matplotlib matplotlib.use("Agg") import matplotlib.pyplot as plt ``` 2. Install and pin Matplotlib in a controlled virtual environment or Conda environment rather than manipulating `sys.path` at runtime. 3. If project-local imports are required, package the project properly and restrict imports to a dedicated directory inside the Skill root. Resolve and validate the path before use, and do not prepend shared temporary directories or broad ancestor directories. 4. Run the Skill with least privilege and ensure that its installation directory and Python environment are not writable by untrusted users. 5. Add a regression test that creates a counterfeit module in parent directories and verifies that it cannot override the expected Matplotlib installation.