T09 · Insecure Skill Coding Practices
Error
- Location
- scripts/guard.py:47
- Finding
- Attacker-Controlled Defense Marker Bypasses Guard Rules<![CDATA[ ## Vulnerability Details **File Location**: `scripts/guard.py`, lines 47–54 and 83 **Vulnerability Type**: Trust-boundary bypass through attacker-controlled exemption marker **Risk Level**: High ### Vulnerable Code ```python for gid, cat, rx, sev in PATTERNS: for m in re.finditer(rx, text, re.I): if defense_exempt and sev == "warn": continue if defense_exempt and sev == "block" and cat not in ("G09", "G05", "G07"): # inside a marked defense template, descriptive/defensive mentions # of bypass/tunnel/scan/harvest topics are the point of the file; # only explicit how-to-requests (G09) and attack instructions # (G05/G07) still block. continue ``` ```python result = check(text, defense_exempt=(DEFENSE_MARKER in text)) ``` ### Technical Analysis The guard treats the mere presence of the string `turingnet:defense` as proof that the input is a trusted defensive template. This marker is part of the input being inspected and can therefore be supplied by an attacker. When the marker is present, the guard suppresses all warning findings and suppresses blocking findings except categories `G09`, `G05`, and `G07`. Consequently, matches involving tunnel evasion, scanning, credential harvesting, interference, and several bypass-related patterns can be ignored. The exemption is not tied to a trusted file path, an immutable bundled template, a cryptographic digest, or another provenance control. This violates the principle that trust decisions must not be based on attacker-controlled content. ### Attack Path 1. An attacker creates a draft containing the text `<!-- turingnet:defense -->`. 2. The attacker adds prohibited material that matches an exempted blocking category, such as scanning, tunnel-evasion, or credential-harvesting language. 3. The draft is passed to `scripts/guard.py`, either directly or through `scripts/low_bandwidth_report.py`. 4. `DEFENSE_MARKER in tex ...[truncated 707 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions - Remove content-controlled exemptions. Do not grant trust based on a marker embedded in the inspected document. - Apply the same blocking rules to all untrusted drafts. - If trusted templates require special handling, establish provenance using: - A canonical path restricted to the bundled `templates/` directory. - A manifest of approved template hashes. - Secure path resolution that rejects symlink and traversal escapes. - Prefer context-aware defensive-language detection instead of broadly suppressing whole rule categories. - Add regression tests proving that an attacker-created document containing the marker cannot suppress scanning, credential-harvesting, tunnel-evasion, or interference findings. - Treat unknown or modified defense templates as ordinary untrusted input. ]]>