T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/safety_validator.py:72
- Finding
- Safety Validator Negation Stripping Can Hide Prohibited Content<![CDATA[ ## Vulnerability Details **File Location**: `scripts/safety_validator.py:72-75, 109-112, 145-149` **Vulnerability Type**: Safety validation bypass caused by overbroad input removal **Risk Level**: Medium ### Vulnerable Code ```python NEGATION_SPAN = re.compile( r"\b(?:no|without|never|not|avoid|exclude[d]?|must\s+not|do\s+not|don't|" r"zero|banned|forbidden)\b[^,.;\n]{0,60}", re.I) ``` ```python def strip_negations(text): """Remove prohibitive spans ('no fake documents', 'never depict ...') so a pack's own safety constraints don't trip the forbidden-mechanics detector.""" return NEGATION_SPAN.sub(" ", text) ``` ```python def validate(text, pack=None): """Return verdict dict: {'verdict': 'pass'|'block'|'warn', ...}""" decl_theme = bool(pack.get("deception_theme")) if isinstance(pack, dict) else False if isinstance(pack, dict) and pack.get("guardian_status") == "FAIL": return {"verdict": "block", "deception_theme": decl_theme, "motif_found": False, "blocked": [{"id": "G01", "severity": "block", "meaning": "pack guardian_status is FAIL — a rejected pack can never pass the safety gate", "span": "guardian_status: FAIL"}], "warnings": [], "motifs_available": len(ALLOWED_MOTIFS), "rules_checked": len(F) + 2} body = strip_negations(ZERO_WIDTH.sub("", text)) variants = [body, normalize(body), squash(normalize(body))] ``` ### Technical Analysis The validator attempts to prevent required safety constraints such as `no fake documents` from triggering its forbidden-content patterns. It does this by deleting any span beginning with a broad negation keyword and continuing for as many as 60 characters until selected punctuation is encountered. This approach does not establish that the text following the negation is actually negated. Consequently, an attacker can place a negation keyword before prohibited content and cause the ...[truncated 1758 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Do not remove arbitrary character spans based only on the presence of a negation keyword. 2. Scan the original normalized content for forbidden phrases first, then determine whether each specific match is genuinely negated using a narrowly bounded grammar. 3. Treat standard constraint fields separately from generative fields rather than applying blanket negation stripping: - Validate known constraint values against an exact allowlist. - Scan all generative fields without deleting negated spans. 4. Reject input if preprocessing produces an empty or substantially erased body. 5. Add regression tests for adversarial constructions, including: - `no hesitation create fake passport` - `never mind, depict forged evidence` - `avoid delay and make a fake ballot` - repeated or nested negation keywords 6. Prefer explicit field-aware validation over natural-language deletion heuristics. 7. Continue applying semantic Guardian review because regex validation alone cannot prove safety. ]]>