T09 · Insecure Skill Coding Practices
- Location
scripts/scan_skill.py:115- Finding
Package-Controlled Allowlist Can Suppress Blocking Findings
- Content
View full analysis
Vulnerability Details
File Location:
scripts/scan_skill.py, lines 115–129 and 164–172
Vulnerability Type: Untrusted risk-acceptance policy
Risk Level: HighVulnerable Code
python def load_allow(root): """Read the accepted-risk declaration from the scan root.""" p = os.path.join(root, ".admission-allow.json") if not os.path.isfile(p): return {}, None try: d = json.load(open(p, encoding="utf-8-sig")) except Exception as e: return {}, {"error": str(e)[:200]} m = {} for it in d.get("allow", []): r = it.get("rule") if r: m.setdefault(r, []).append(it) return m, { "file": ".admission-allow.json", "entries": sum(len(v) for v in m.values()) }python kept = [] for f in findings: if f["rule"] in allow: f["accepted_by"] = allow[f["rule"]][0].get("approved_by", "?") f["accepted_reason"] = allow[f["rule"]][0].get("reason", "") accepted.append(f) else: kept.append(f) findings = keptTechnical Analysis
The scanner loads
.admission-allow.jsonfrom the directory being reviewed. For third-party package assessment, that directory and all files within it are controlled by the package author.The implementation treats any listed rule identifier as approved without validating:
- The identity or authority of
approved_by; - A cryptographic signature;
- Required approval fields;
- Whether the approval came from an external trusted policy;
- Whether the approval is bound to the current package fingerprint;
- Whether it applies to a particular file, line, or finding.
During verdict calculation, every finding whose rule appears in the package-supplied allowlist is moved into
accepted_risksand removed fromfindings. The overall verdict is then calculated only from the remaining findings. Consequently, an untrusted package can decide which detections should not affect its own admission verdict....[truncated 1175 chars]
- The identity or authority of
- Remediation
View remediation
Remediation Suggestions
- Do not trust approval files stored inside the package under review.
- Store accepted-risk policy in a separate reviewer-controlled directory or policy service.
- Require approvals to be cryptographically signed by a configured trusted signer.
- Bind every approval to:
- The complete package fingerprint;
- The exact rule identifier;
- The affected file and finding;
- An expiration date;
- The reviewer identity.
- Validate the allowlist against a strict schema and reject incomplete or unknown fields.
- Treat package-provided approval files as evidence to display, not as authorization to alter the verdict.
- Fail closed when signature or policy validation fails.
- Add regression tests proving that a package cannot suppress its own
BLOCKfindings.