T09 · Insecure Skill Coding Practices
- Location
chart_gen.py:13- Finding
Unsafe Python Import Path Enables Local Module Hijacking
- Content
View full analysis
Vulnerability Details
File Location:
chart_gen.py, lines 13–18
Vulnerability Type: Python import path hijacking
Risk Level: MediumVulnerable Code
python import json # 使用 conda 环境中的 matplotlib sys.path.insert(0, os.path.join(os.path.dirname(os.path.abspath(__file__)), '../../..')) import matplotlib matplotlib.use('Agg') # 非交互式后端 import matplotlib.pyplot as pltTechnical Analysis
The script prepends an ancestor directory to
sys.pathbefore importingmatplotlib. Because index zero has the highest import precedence, Python searches this ancestor directory before trusted environment and site-package locations.If an attacker can write a counterfeit
matplotlib.pyfile ormatplotlib/package into that ancestor directory, Python may load it instead of the legitimate Matplotlib dependency. Top-level Python statements in the counterfeit module execute immediately during import.The vulnerable path is derived from the script location rather than from a verified, private package directory. In the audited deployment layout, traversing three parent levels reaches a directory outside the Skill root and may expose import resolution to files controlled by another local process or user. Exploitation therefore depends on the attacker having write access to that ancestor directory.
Attack Path
- The attacker obtains write access to the directory resolved by
../../..relative tochart_gen.py. - The attacker creates a malicious
matplotlib.pyfile ormatplotlib/package in that directory. - A user or automated agent invokes
chart_gen.pyfor legitimate chart generation. - The
sys.path.insert(0, ...)call gives the attacker-controlled location precedence over the installed Python packages. - The subsequent
import matplotlibloads the counterfeit module. - The attacker's top-level Python payload executes with the identity and permissions of the process running the Skill.
Impact Assessment
Successful exploi ...[truncated 524 chars]
- The attacker obtains write access to the directory resolved by
- Remediation
View remediation
Remediation Suggestions
- Remove the ancestor-directory insertion and rely on the configured Python environment:
python import matplotlib matplotlib.use("Agg") import matplotlib.pyplot as plt-
Install and pin Matplotlib in a controlled virtual environment or Conda environment rather than manipulating
sys.pathat runtime. -
If project-local imports are required, package the project properly and restrict imports to a dedicated directory inside the Skill root. Resolve and validate the path before use, and do not prepend shared temporary directories or broad ancestor directories.
-
Run the Skill with least privilege and ensure that its installation directory and Python environment are not writable by untrusted users.
-
Add a regression test that creates a counterfeit module in parent directories and verifies that it cannot override the expected Matplotlib installation.