T08 · Insecure Dependencies
Error
- Location
- tools/financial_fetcher.py:11
- Finding
- Untrusted External Module Execution Through Runtime Path Injection## Vulnerability Details **File Location**: `tools/financial_fetcher.py`, lines 11–17 **Vulnerability Type**: Untrusted dependency loading and arbitrary Python code execution **Risk Level**: High ```python _base = os.path.dirname(os.path.dirname(os.path.dirname(os.path.dirname(os.path.abspath(__file__))))) _trading_src = os.path.join(_base, 'toc-trading', 'src') if _trading_src not in sys.path: sys.path.insert(0, _trading_src) from stock_data_adapter import StockDataAdapter ``` ### Technical Analysis The script derives a location outside the Skill package, prepends that location to `sys.path`, and imports `stock_data_adapter` without verifying its origin, ownership, permissions, or integrity. Given the supplied project location, the derived import directory resolves to `/tmp/toc-trading/src`. Because `/tmp` is normally a shared location, another local user or process may be able to create or replace the expected module. Placing this directory at index zero in `sys.path` gives it precedence over other module locations. Python executes module-level code immediately during an import. Consequently, a malicious `stock_data_adapter.py` in the derived directory can execute arbitrary Python code before `StockDataAdapter` is instantiated. No cryptographic digest, trusted package installation, canonical-path validation, or restrictive permission check protects this import. ### Attack Path 1. An attacker with local write access creates `/tmp/toc-trading/src` if it does not already exist. 2. The attacker places a malicious `stock_data_adapter.py` in that directory. 3. The Agent invokes `tools/financial_fetcher.py` as part of a stock-analysis request. 4. The script inserts `/tmp/toc-trading/src` at the beginning of `sys.path`. 5. Python imports and executes the attacker-controlled module. 6. The malicious module runs with the same operating-system identity and privileges as the Agent process. ### Impact Assessment Successful exploitation provides arbitrary Py ...[truncated 543 chars]
- Remediation
- ## Remediation Suggestions - Package `stock_data_adapter` inside the reviewed Skill or install it as a pinned, trusted dependency through a controlled package-management process. - Do not prepend shared or externally writable directories to `sys.path`. - Use a normal package import from an isolated virtual environment with exact dependency versions and verified hashes. - If external module loading is unavoidable: - Resolve the module directory to a canonical path and require it to be within an explicitly trusted root. - Reject symbolic links and unexpected path components. - Verify that the directory and module are owned by a trusted account and are not writable by untrusted users. - Verify the module against a pinned cryptographic digest or signed manifest before importing it. - Run the Skill under a dedicated least-privileged identity and expose only the environment variables and filesystem locations required for the task.