T09 · Insecure Skill Coding Practices
- Location
scripts/audit_skill.py:267- Finding
Attacker-Controlled Suppression Bypasses Mandatory P0 Audit Gates
- Content
View full analysis
Vulnerability Details
File Location:
scripts/audit_skill.py:267-275, 304-320, 360-366, 921-936; downstream packaging and installation atscripts/pack_skill.py:508, 562, 595
Vulnerability Type: Security validation bypass
Risk Level: HighComplete Code Snippets
scripts/audit_skill.py:267-275:python class Report: def __init__(self, ignored_rules=None): self._map = {} self.ignored_rules = set(ignored_rules or ()) self.ignored_hits = 0 def add(self, sev, cat, file, rule, line, sample, hint): if rule in self.ignored_rules: self.ignored_hits += 1 returnscripts/audit_skill.py:304-320:python def load_skillignore(root: Path): p = root / ".skillignore" globs, rules = [], set() if not p.exists(): return globs, rules for line in (read_text(p) or "").splitlines(): s = line.strip() if not s or s.startswith("#"): continue if s.lower().startswith("rule:"): rules.add(s[len("rule:"):].strip()) else: globs.append(s.rstrip("/")) return globs, rulesscripts/audit_skill.py:360-366:python def scan_lines(path: Path): text = read_text(path) if text is None: return for i, line in enumerate(text.splitlines(), 1): if "skill-audit: ignore" in line: continuescripts/audit_skill.py:921-936:python def audit(root: Path, market: bool = False, ignored_rules=None, ignore_globs=None) -> Report: si_globs, si_rules = load_skillignore(root) rep = Report(ignored_rules=set(ignored_rules or ()) | si_rules) if not root.exists() or not root.is_dir(): rep.add("P0", "参数", root, "目录无效", 0, "目录不存在或不是目录", "") return rep content = check_structure(root, rep, market) if market and content is not None: check_market(root, rep, content) files, junk_dirs = walk_tree(root, list(ignore_globs or ()) + si_glob ...[truncated 3066 chars]- Remediation
View remediation
Remediation Suggestions
- Prohibit all suppression of P0 rules. In
Report.add(), apply ignored-rule handling only after verifying thatsevis notP0:
python if sev != "P0" and rule in self.ignored_rules: self.ignored_hits += 1 return-
Maintain an explicit allowlist of suppressible P1/P2 rule identifiers. Reject unknown rule names and any attempt to suppress credential, dangerous-execution, or structural P0 checks.
-
Replace the generic substring check in
scan_lines()with a structured exemption parser that:- is limited to approved executable file types;
- requires an exact end-of-line annotation;
- names the specific rule being exempted;
- permits only allowlisted P1/P2 rules; and
- never skips the entire line before P0 checks run.
-
Treat
.skillignoreas untrusted policy input. Separate file-exclusion patterns from audit-rule exemptions and display every accepted exemption prominently in packaging output. -
Before packaging, run a second non-suppressible P0 pass over every file that will be included in the archive. Installation must use the same validated file set.
-
Add regression tests covering every P0 rule through both suppression mechanisms. Tests should verify that
.skillignore,--ignore-rule, and inline markers cannot reduce a P0 finding or permit packaging.
- Prohibit all suppression of P0 rules. In