T09 · Insecure Skill Coding Practices
- Location
scan.py:301- Finding
Directory Name Allows Complete Scan Bypass and Misleading Clean Verdict
- Content
View full analysis
Vulnerability Details
File Location:
scan.py:301-304, with misleading report handling atscan.py:367-371
Vulnerability Type: Name-based security scan bypass
Risk Level: MediumVulnerable Code
python # Skip self (don't scan our own source — we contain detection patterns by design) SELF_SLUG = "clawskillguard" if skill_name == SELF_SLUG: result.errors.append("Self-scan skipped (ClawSkillGuard contains detection patterns by design)") return resultThe returned result is subsequently treated as clean because it contains no findings:
python if not result.findings: lines.append(f"✅ No security issues detected.") lines.append(f"") lines.append(f"Verdict: {result.verdict}") return "\n".join(lines)Technical Analysis
The scanner identifies itself solely through the basename of the target directory. It does not verify that the target is the scanner's actual canonical directory or that its files match the trusted scanner package.
Consequently, any unrelated or attacker-controlled directory named
clawskillguardcausesscan_skill()to return before traversing or inspecting its files. Although an error is recorded, the result contains no findings.ScanResult.max_severityconsequently resolves toCLEAN, and the text formatter reports both “No security issues detected” and a clean verdict.This is a fail-open design: an exceptional condition that prevents security analysis is represented as a successful security outcome. The bypass applies to every scanner check, including prompt-injection, malicious-code, suspicious-import, and configuration analysis.
Attack Path
- An attacker creates a malicious Skill containing code or instructions that would ordinarily trigger the scanner.
- The attacker packages or installs it in a directory whose basename is exactly
clawskillguard. - A user or automated process invokes the scanner against that d ...[truncated 1036 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove the basename-based exemption. Scanning should not be skipped merely because a target uses a reserved directory name.
- If self-scan suppression is required, compare canonical paths against the scanner's actual source directory, for example by resolving both
skill_dirandPath(__file__).parent. - Prefer allowing self-scans and suppress only narrowly identified signatures known to originate from the scanner's static detection tables.
- Introduce a distinct scan status such as
ERRORorNOT_SCANNED. A result containing scan errors or an intentional skip must never inherit aCLEANverdict. - Make report generation fail closed: if no files were inspected, scanning was skipped, or a fatal error occurred, report “SCAN INCOMPLETE — NO SAFETY VERDICT” and return a nonzero process exit status.
- Add regression tests covering:
- An unrelated malicious target named
clawskillguard. - The scanner's genuine source directory.
- Results containing errors but no findings.
- Text and JSON output for skipped or incomplete scans.
- An unrelated malicious target named
- Ensure automation can distinguish clean, vulnerable, and incomplete outcomes through explicit status fields and documented exit codes.