T09 · Insecure Skill Coding Practices
- Location
scripts/scan.py:70- Finding
Incomplete File-Type Coverage Allows Malicious Content to Evade Scanning
- Content
View full analysis
Vulnerability Details
File Location:
scripts/scan.py, lines 70-77
Vulnerability Type: Incomplete security scanning coverage
Risk Level: HighVulnerable Code:
python # Find files exts = {".md", ".py", ".js", ".ts", ".sh", ".jsx", ".tsx"} files = [] for root, dirs, fnames in os.walk(skill_path): dirs[:] = [d for d in dirs if d not in ("node_modules", ".git", "__pycache__")] for fn in fnames: if os.path.splitext(fn)[1] in exts: files.append(os.path.join(root, fn))Technical Analysis
The scanner uses a narrow, case-sensitive extension allowlist to decide which files receive security analysis. It silently excludes common executable, configuration, and instruction-bearing formats, including extensionless scripts,
.json,.yaml,.yml,.toml,.mjs,.cjs,.ps1, and.bat. Uppercase or mixed-case variants such asRUN.SHare also excluded.This is especially significant for a tool whose declared purpose is to assess untrusted Skill packages before installation. The scanner does not inspect omitted files and does not report them as skipped, yet it may still produce a
PASSverdict. The bundledrules.jsonitself is excluded by this logic.Attack Path
- An attacker creates a Skill containing malicious instructions or executable content.
- The malicious content is placed in an unsupported file such as
payload,config.json,setup.ps1, orRUN.SH. - A victim invokes MoltCops against the untrusted Skill directory.
- The extension check omits the malicious file without warning.
- No critical or high-severity rule matches are produced from the omitted content.
- The scanner may return
PASS, encouraging the victim to install or execute the malicious Skill. - The omitted payload can subsequently run through the target Skill's own installation or execution workflow.
Impact Assessment
This flaw does not directly grant the ...[truncated 564 chars]
- Remediation
View remediation
Remediation Suggestions
- Scan all regular files by default rather than relying on a narrow extension allowlist.
- Detect binary files using content inspection and skip only files that are confidently binary.
- Normalize file extensions with
.lower()if an allowlist remains necessary. - Add support for common executable, configuration, and instruction formats, including extensionless scripts, JSON, YAML, TOML, PowerShell, batch files, and modern JavaScript module extensions.
- Apply configurable file-size and traversal limits to prevent resource exhaustion when broadening coverage.
- Explicitly list every skipped file and the reason it was skipped.
- Do not return
PASSwhen potentially relevant files were not inspected; return an incomplete-scan warning instead. - Add regression tests using malicious patterns in unsupported, extensionless, uppercase, and mixed-case filenames.