T09 · Insecure Skill Coding Practices
Error
- Location
scripts/audit.py:641- Finding
Target-Controlled Severity Caps Allow Critical Findings to Pass CI
- Content
View full analysis
tuple[str | None, int]: skill_md = skill_path / "SKILL.md" if not skill_md.exists(): return None, 0 try: text = skill_md.read_text(encoding="utf-8", errors="replace") except Exception: return None, 0 fm = parse_frontmatter(text) if not fm: return None, 0 cap = None if fm.get("engine-class") is True or fm.get("engine-class") == "true": cap = "high" if "severity-cap" in fm: cap_val = str(fm["severity-cap"]).lower() if cap_val in SEVERITY_ORDER: cap = cap_val if not cap: return None, 0 cap_rank = SEVERITY_ORDER[cap] downgraded = 0 for f in findings: if SEVERITY_ORDER[f["severity"]] > cap_rank: old_severity = f["severity"] f["severity"] = cap f["original_severity"] = f.get("original_severity", old_severity) downgraded += 1 return cap, downgraded ``` ```python "verdict_code": "fail" if by_severity["critical"] > 0 else ( "caution" if by_severity["high"] > 0 else ( "review" if by_severity["medium"] > 0 else "ok" ) ), ``` ```python if args.exit_code: max_severity = "info" for sev, cnt in report["summary"]["by_severity"].items(): if cnt > 0 and SEVERITY_ORDER[sev] > SEVERITY_ORDER[max_severity]: max_severity = sev sys.exit(SEVERITY_EXIT[max_severity]) ``` ### Technical Analysis The scanner reads `severity-cap` and `engine-class` from the target Skill's own `SKILL.md`. It then mutates every finding's effective `severity` before constructing the report. The human-readable primary verdict attempts to compensate by c ...[truncated 1773 chars]- Remediation
View remediation