T09 · Insecure Skill Coding Practices
Error
- Location
scripts/engine/sandbox.py:29- Finding
Python Code Node Sandbox Permits Arbitrary Filesystem Access and Unbounded Execution
- Content
View full analysis
SandboxResult: ``` ```python namespace: Dict[str, Any] = dict(variables) namespace["ctx_export"] = ctx_export namespace["__builtins__"] = dict(SAFE_BUILTINS) namespace["__builtins__"]["__import__"] = _safe_import old_stdout = sys.stdout try: sys.stdout = captured exec(compile(code, "", "exec"), namespace) ``` ### Technical Analysis The `code` node is described as executing Python in a sandbox, but the sandbox exposes the native `open()` function and allows importing `pathlib`. Consequently, workflow code can read, create, overwrite, or truncate any file accessible to the workflow process. Execution occurs through in-process `exec()`, so the code shares the interpreter, memory, privileges, and resources of the workflow engine. Although `execute_code()` accepts a `timeout` parameter, that parameter is never enforced. A workflow can therefore execute an infinite loop, consume excessive memory, or otherwise block the engine indefinitely. Restricting imports does not establish a security boundary when powerful filesystem primitives and host objects remain available. ### Attack Path 1. An attacker supplies or modifies a workflow containing a `code` node. 2. The node executes Python such as: ```python result = open("/home/user/.openclaw/openclaw.json").read() ``` 3. The engine reads the file with the current user's privileges. 4. The result becomes workflow output and may subsequently be logged, persisted, sent to an Agent, or transmitted through an HTTP or message node. For denial of service, the attacker can in ...[truncated 718 chars]- Remediation
View remediation