T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/guard_scanner.py:378
- Finding
- Directory Scans Exclude Executable Skill Files## Vulnerability Details **File Location**: `scripts/guard_scanner.py:378-381` **Vulnerability Type**: Incomplete security scanning coverage **Risk Level**: Medium ```python if args.file: skill_path = Path(args.file) if skill_path.is_dir(): skill_path = skill_path / "SKILL.md" try: with open(skill_path) as f: code = f.read() ``` ### Technical Analysis When the supplied path is a directory, the scanner replaces it with the path to `SKILL.md`. It therefore scans only the documentation file and does not inspect other files in the skill package, including executable content under `scripts/`. This behavior conflicts with the scanner's stated purpose of checking a skill for malicious code before installation. Because omitted files are not reported as skipped, an approval result may appear to cover the complete package even though only its manifest was analyzed. ### Attack Path 1. An attacker creates a skill package containing an innocuous `SKILL.md`. 2. The attacker places malicious or otherwise dangerous code in another packaged file, such as `scripts/payload.py`. 3. A reviewer invokes the scanner with the skill directory through `--file`. 4. The scanner automatically changes the input path to `<directory>/SKILL.md`. 5. Only the benign Markdown file is passed to the detection engines. 6. The scanner may return an approval while the malicious executable file remains unexamined. 7. If the package is subsequently installed or invoked, the omitted code can execute according to the permissions of the invoking user or agent. ### Impact Assessment This flaw enables a security-control bypass and false-negative scan results. It does not itself execute attacker code or grant additional privileges. However, it can facilitate installation of an unreviewed malicious skill whose scripts may subsequently operate with all filesystem, process, network, and tool permissions available to t ...[truncated 278 chars]
- Remediation
- ## Remediation Suggestions - Recursively enumerate and scan all regular files beneath a supplied skill directory rather than rewriting the input path to `SKILL.md`. - Prioritize executable and configuration formats, including Python, shell, JavaScript, TypeScript, PowerShell, YAML, JSON, and package manifests. - Resolve each path and verify that it remains beneath the original package root. - Do not follow symbolic links by default; otherwise, explicitly validate resolved symlink targets to prevent traversal outside the package. - Apply per-file and aggregate size limits to prevent memory exhaustion. - Handle binary, unreadable, and unsupported files explicitly and include them in a `skipped_files` or `scan_errors` section. - Treat incomplete coverage as a warning or blocking condition rather than returning an unconditional approval. - Include the list and count of scanned files in both human-readable and JSON reports. - Add a regression test containing a benign `SKILL.md` and a malicious pattern under `scripts/`, verifying that a directory scan detects the script.