T07 · Tool Hijacking and Spoofing
Error
- Location
- SKILL.md:445
- Finding
- Workspace Import-Path Precedence Enables Python Module Hijacking<![CDATA[ ## Vulnerability Details **File Location**: `SKILL.md:445-447` **Vulnerability Type**: Untrusted Python import-path precedence **Risk Level**: High ### Vulnerable Code ```python EVOLVER_DIR = os.path.join(WORKSPACE, "evolver") sys.path.insert(0, EVOLVER_DIR) from init_evolver import load_evolver_for_agent ``` ### Technical Analysis The documented integration procedure inserts a workspace-controlled directory at index zero of `sys.path`. Python therefore searches this directory before standard and installed package locations when resolving `init_evolver`. The imported `init_evolver` module is not included in the audited project. Consequently, its identity and integrity are not established by this package. Importing a Python module executes its top-level code immediately, so a malicious `init_evolver.py` placed in the workspace would obtain arbitrary Python code execution when the Agent follows these deployment instructions. Exploitation requires an attacker, compromised process, or lower-trust component to be able to create or replace files in `WORKSPACE/evolver`. This is a conditional local trust-boundary vulnerability rather than evidence that the audited package itself contains a malicious payload. ### Attack Path 1. The Agent or operator configures `WORKSPACE` as described in `SKILL.md`. 2. An attacker or compromised local component obtains write access to `WORKSPACE/evolver`. 3. The attacker creates `WORKSPACE/evolver/init_evolver.py` containing malicious top-level Python code. 4. The Agent executes the documented initialization snippet. 5. `sys.path.insert(0, EVOLVER_DIR)` gives the attacker-controlled directory highest import precedence. 6. `from init_evolver import load_evolver_for_agent` loads the malicious file and executes its top-level code. 7. The payload runs with the same operating-system identity, filesystem access, environment variables, and network permissions as the Agent process. ### Impact Assessment Successful exploitatio ...[truncated 489 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Package `init_evolver` as a verified module within the distributed project rather than loading it from a mutable workspace. 2. Use an explicit package import, such as: ```python from cybernetic_evolver.init_evolver import load_evolver_for_agent ``` 3. Do not prepend writable directories to `sys.path`. If path modification is unavoidable, use a trusted, read-only installation directory and avoid index-zero insertion. 4. Resolve the expected module path and verify that it remains inside an approved directory before importing it. 5. Restrict directory ownership and permissions so lower-trust users and processes cannot modify Python source files loaded by the Agent. 6. For high-integrity deployments, verify the module against a pinned cryptographic hash or signed release manifest before loading it. 7. Document the source, expected location, and integrity requirements of `init_evolver`. ]]>