T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/scan.py:70
- Finding
- Incomplete File-Type Coverage Allows Malicious Content to Evade Scanning## Vulnerability Details **File Location**: `scripts/scan.py`, lines 70-77 **Vulnerability Type**: Incomplete security scanning coverage **Risk Level**: High **Vulnerable Code**: ```python # Find files exts = {".md", ".py", ".js", ".ts", ".sh", ".jsx", ".tsx"} files = [] for root, dirs, fnames in os.walk(skill_path): dirs[:] = [d for d in dirs if d not in ("node_modules", ".git", "__pycache__")] for fn in fnames: if os.path.splitext(fn)[1] in exts: files.append(os.path.join(root, fn)) ``` ### Technical Analysis The scanner uses a narrow, case-sensitive extension allowlist to decide which files receive security analysis. It silently excludes common executable, configuration, and instruction-bearing formats, including extensionless scripts, `.json`, `.yaml`, `.yml`, `.toml`, `.mjs`, `.cjs`, `.ps1`, and `.bat`. Uppercase or mixed-case variants such as `RUN.SH` are also excluded. This is especially significant for a tool whose declared purpose is to assess untrusted Skill packages before installation. The scanner does not inspect omitted files and does not report them as skipped, yet it may still produce a `PASS` verdict. The bundled `rules.json` itself is excluded by this logic. ### Attack Path 1. An attacker creates a Skill containing malicious instructions or executable content. 2. The malicious content is placed in an unsupported file such as `payload`, `config.json`, `setup.ps1`, or `RUN.SH`. 3. A victim invokes MoltCops against the untrusted Skill directory. 4. The extension check omits the malicious file without warning. 5. No critical or high-severity rule matches are produced from the omitted content. 6. The scanner may return `PASS`, encouraging the victim to install or execute the malicious Skill. 7. The omitted payload can subsequently run through the target Skill's own installation or execution workflow. ### Impact Assessment This flaw does not directly grant the ...[truncated 564 chars]
- Remediation
- ## Remediation Suggestions - Scan all regular files by default rather than relying on a narrow extension allowlist. - Detect binary files using content inspection and skip only files that are confidently binary. - Normalize file extensions with `.lower()` if an allowlist remains necessary. - Add support for common executable, configuration, and instruction formats, including extensionless scripts, JSON, YAML, TOML, PowerShell, batch files, and modern JavaScript module extensions. - Apply configurable file-size and traversal limits to prevent resource exhaustion when broadening coverage. - Explicitly list every skipped file and the reason it was skipped. - Do not return `PASS` when potentially relevant files were not inspected; return an incomplete-scan warning instead. - Add regression tests using malicious patterns in unsupported, extensionless, uppercase, and mixed-case filenames.