T08 · Insecure Dependencies
- Location
scripts/ccpa-check.py:12- Finding
Untrusted Out-of-Project Python Module Import
- Content
View full analysis
Vulnerability Details
File Location:
scripts/ccpa-check.py, lines 12–15
Vulnerability Type: Untrusted search-path modification and external module loading
Risk Level: MediumVulnerable code:
python # Ensure compliance_core can be imported sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', '..')) from compliance_core import UnifiedCLI, CheckEngine, CheckResult, SeverityTechnical Analysis
The script prepends a directory outside the audited project to Python's module search path and then imports
compliance_core. That module is not included in the audited project.Because the inserted directory has the highest import precedence, Python will execute the initialization code of any
compliance_corepackage found there. The implementation therefore places executable trust in an adjacent, unaudited component and contradicts the project's documented claim that it has no external dependencies.The problem is also reachable indirectly through
scripts/security_check_ccpa.py, which launchesccpa-check.py --helpas a functional test. Argument parsing does not protect this path because Python resolves the import beforemain()handles--help.Attack Path
- An attacker obtains write access to the directory two levels above
scripts/ccpa-check.py, or compromises a pre-existing adjacentcompliance_corepackage. - The attacker creates or modifies
compliance_core/__init__.pyand places arbitrary Python statements in its module initialization path. - A user runs either:
python scripts/ccpa-check.py, orpython scripts/security_check_ccpa.py.
- The script prepends the attacker-influenced parent directory to
sys.path. - Python imports the attacker-controlled
compliance_corepackage. - Its initialization code executes before the compliance checker performs its intended work.
Exploitation requires the attacker to control the relevant parent-direc ...[truncated 705 chars]
- An attacker obtains write access to the directory two levels above
- Remediation
View remediation
Remediation Suggestions
- Remove the parent-directory search-path modification:
python sys.path.insert(0, os.path.join(os.path.dirname(__file__), '..', '..')) - Bundle
compliance_corewithin the audited distribution and import it through a package-relative path, or declare it as a version-pinned dependency obtained from a trusted and integrity-verified source. - If loading an adjacent component is an intentional deployment requirement, resolve its canonical path and reject locations outside an explicitly trusted installation root. Validate ownership and permissions before importing it.
- Avoid relying on the current working directory or broadly writable parent directories for module discovery.
- Test the packaged Skill in an isolated environment to ensure that only bundled or explicitly installed dependencies are importable.
- Update the README, Skill description, package metadata, and dependency documentation so that the external runtime requirement is accurately disclosed.
- Modify the security checker so it does not execute a target whose dependencies have not first been resolved and validated.
- Remove the parent-directory search-path modification: