T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/security_scanner.py:190
- Finding
- Security scanner omits instruction-bearing and unsupported file types from dangerous-pattern analysis<![CDATA[ ## Vulnerability Details **File Location**: `scripts/security_scanner.py:190-205` and `scripts/security_scanner.py:320-350` **Vulnerability Type**: Incomplete security-analysis coverage **Risk Level**: High ### Complete Code Snippet ```python # Scan all code files for ext in ['.py', '.js', '.ts', '.sh', '.bash', '.ps1']: for file_path in skill_path.rglob(f'*{ext}'): if self._should_scan_file(file_path): self._scan_file(file_path) # Scan SKILL.md skill_md = skill_path / 'SKILL.md' if skill_md.exists(): self._scan_skill_metadata(skill_md) # Scan dependency files for dep_file in ['package.json', 'requirements.txt', 'Pipfile', 'pyproject.toml']: dep_path = skill_path / dep_file if dep_path.exists(): self._scan_dependencies(dep_path) ``` The separate metadata scanner does not apply the dangerous-pattern rules: ```python def _scan_skill_metadata(self, skill_md_path: Path): """Scan SKILL.md metadata""" try: with open(skill_md_path, 'r', encoding='utf-8') as f: content = f.read() except Exception: return # Check whether enough documentation is provided if len(content) < 500: self.findings.append(SecurityFinding( rule_id="DOC001", rule_name="Documentation too short", description="SKILL.md has insufficient content and may lack adequate functionality documentation", risk_level=RiskLevel.LOW, file_path="SKILL.md", line_number=0, code_snippet="", recommendation="Provide detailed Skill functionality and usage documentation" )) # Check whether network requirements are described has_network_pattern = r'\b(network|http|request|api|url|endpoint|server)\b' if re.search(has_network_pattern, content, re.IGNORECASE): security_pattern = r'\b(security|privacy|data|sensitive|credential)\b' if not re.search(security_pattern, content, re.IGNO ...[truncated 3150 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Enumerate every archive entry and project file rather than using a small executable-extension allowlist as the complete scan boundary. 2. Apply relevant dangerous-pattern and instruction-hijacking checks to `SKILL.md` and all recursively discovered Markdown files. 3. Inspect HTML and SVG files for scripts, event handlers, external-resource references, embedded data, and active content. 4. Analyze configuration formats such as JSON, YAML, TOML, XML, and workflow definitions for commands, hooks, external URLs, and unsafe installation behavior. 5. Treat unknown extensions, extensionless files, unreadable files, and unsupported binary formats as explicit coverage warnings. 6. Report both the number of files discovered and the number fully analyzed so users can identify incomplete coverage. 7. Prevent a `PASS` verdict when security-relevant files were skipped or could not be read. 8. Add tests containing malicious patterns in root Markdown, nested Markdown, HTML, SVG, extensionless scripts, and uncommon executable formats. 9. Clearly document that static pattern matching cannot establish that a Skill is safe and avoid presenting `PASS` as an installation safety guarantee. ]]>