T09 · Insecure Skill Coding Practices
- Location
scripts/hash_check.py:41- Finding
Integrity verification reports success when untrusted files are added
- Content
View full analysis
Vulnerability Details
File Location:
scripts/hash_check.py, lines 41–58
Vulnerability Type: Incomplete integrity validation
Risk Level: MediumVulnerable Code
python missing = sorted(set(base) - set(cur)) added = sorted(set(cur) - set(base)) changed = sorted(k for k in set(base) & set(cur) if base[k] != cur[k]) ok = not missing and not changed if a.json: print(json.dumps({"ok": ok, "checked": len(base), "missing": missing, "added": added, "changed": changed}, ensure_ascii=False, indent=2)) else: print("校验: %d/%d 一致%s" % (len(base) - len(changed), len(base), " ｜ PASS" if ok else " ｜ FAIL")) for k in changed: print(" [改动] " + k) for k in missing: print(" [缺失] " + k) for k in added: print(" [新增] " + k) sys.exit(0 if ok else 1)Technical Analysis
The script identifies files that exist in the checked directory but not in the trusted manifest through the
addedcollection. However, the success condition only considers missing and modified files:python ok = not missing and not changedConsequently, any number of unmanifested files can be present while the verifier reports
PASS, emits"ok": truein JSON mode, and exits with status code 0.This behavior conflicts with the Skill's documented purpose of detecting tampering in downloaded or transferred directories. In an automated workflow, exit code 0 or the JSON
okfield is likely to be treated as authoritative, while the informationaladdedlist may not be separately enforced.The manifest itself is normally written inside the scanned directory. Because scanning occurs before manifest generation, a subsequent check also sees the manifest as an added file. Any correction must therefore exclude the manifest from the scan or place it outside the protected directory before treating additions as failures.
Attack Path
- A user generates a trusted SHA-256 manifest for a directory.
- The directo ...[truncated 1236 chars]
- Remediation
View remediation
Remediation Suggestions
- Include added files in the failure condition:
python ok = not missing and not added and not changed-
Prevent the manifest itself from being classified as an added file. Prefer storing the manifest outside the protected directory. Alternatively, resolve its canonical path and explicitly exclude only that exact file during scanning.
-
Make strict verification the default. If workflows legitimately permit additional files, provide an explicit option such as
--allow-addedrather than silently accepting them. -
Ensure both human-readable and JSON output clearly report failure whenever unmanifested files are present.
-
Add regression tests covering:
- an unchanged directory;
- a modified manifest-listed file;
- a deleted manifest-listed file;
- one or more newly added files;
- the manifest stored inside the target directory;
- strict and explicitly permissive modes.