T09 · Insecure Skill Coding Practices
Error
- Location
scripts/scan_skill.py:148- Finding
Whole-Line Whitelist Allows Trivial Signature-Detection Bypass
- Content
View full analysis
Vulnerability Details
File Location:
scripts/scan_skill.py:148-153, 219-224, 241-242
Vulnerability Type: Detection bypass caused by overly broad whitelisting
Risk Level: HighVulnerable Code
python WHITELIST_PATTERNS = [ r'# ', # Comments r'"""', # Docstrings r"'''", r'https://api\.', # Standard API calls r'localhost|127\.0\.0\.1', # Local only ]python def is_whitelisted(line: str) -> bool: """Check if line matches whitelist patterns.""" for pattern in WHITELIST_PATTERNS: if re.search(pattern, line, re.IGNORECASE): return True return Falsepython for line_num, line in enumerate(lines, 1): # Skip whitelisted lines if is_whitelisted(line): continueTechnical Analysis
The scanner applies whitelist expressions to an entire source line before running any critical, warning, or informational security checks. A match anywhere on the line causes the scanner to skip that line completely.
The whitelist expressions are not restricted to syntactically verified comments, docstrings, string literals, or safe network operations. In particular:
#can be appended as a normal Python or shell comment after executable malicious code."""and'''may occur in executable expressions or arguments and are not necessarily documentation.https://api.can be inserted into an otherwise dangerous line.localhostor127.0.0.1can be included in an unrelated string or comment.
Because matching is substring-based rather than syntax-aware, an attacker can combine a known critical pattern with any whitelist token and suppress the finding.
Attack Path
- An attacker creates a Skill containing an operation that would normally match a critical signature, such as:
python os.system(command) # bypass - The scanner reads the line and calls `is_whitelist ...[truncated 1122 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the global line-level whitelist and run security checks before applying any suppression.
- Use language-aware parsers:
- Use Python's
astandtokenizemodules to distinguish executable code from comments and docstrings. - Use appropriate parsers for JavaScript, TypeScript, shell, YAML, and other supported formats.
- Use Python's
- Apply suppressions only to the exact non-executable token or span that has been proven safe; never suppress all checks for a line because one substring matched.
- Do not treat API URLs or localhost references as inherently safe. A line can communicate with a legitimate-looking endpoint while also executing dangerous behavior.
- Add regression tests containing dangerous patterns followed by every whitelist token, including:
python os.system(command) # comment exec(payload_with_triple_quote) subprocess.run(command, shell=True) # https://api.example - Make explicit suppressions narrowly scoped and auditable, such as a dedicated annotation tied to one rule, and report suppressed findings in scanner output.
- Fail closed when parsing is unsuccessful rather than treating ambiguous content as safe.