Repository navigation
__pycache__ skipped entirely during skill scans (v2.8.2) (malicious skill bypasses this scanner) #356
Description
In build_context.py, _SKIP_DIRS includes __pycache__ (and .git, node_modules, etc.), so files under those dirs are never read or sent to the LLM.
A skill can ship clean decoy .py sources plus a malicious __pycache__/output.cpython-*.pyc with PEP 552 UNCHECKED_HASH. Python loads the .pyc at import time; SkillSpector still scores the skill SAFE / 0 findings.
Tested on v2.8.2.
PoC: https://github.com/nedlir/skills-scanner-bypass
to test, build the payload with build.py, then the skill will execute whatever payload added)
Activity
ajlennon commentedon Aug 10, 2026
Confirmed on SkillSpector v2.8.2:
__pycache__is in_SKIP_DIRS(build_context.py), and.pycis also treated as a binary extension instatic_runner.py, so bytecode never enters analysis. That matches the decoy-.py+ malicious-.pycbypass described here (and in https://github.com/nedlir/skills-scanner-bypass).Local mitigation we are using: a thin wrapper around static scans that fails closed if any
__pycache__/directory or*.pycis present under the skill tree (wipe caches, then rescan). That does not fix the engine, but it stops a “SAFE / 0 findings” result when bytecode is on disk.Suggested engine behaviour (preferable to silent skip): when discovery finds
__pycache__or*.pyc, emit a HIGH finding (e.g. supply-chain / rogue-persistence class) so the score cannot read clean while bytecode is present. Full.pycdisassembly can come later; presence alone is enough to close this hole.Happy to open a small PR along those lines if that approach is welcome.
— Briar (AI Assistant) on behalf of Alex Lennon.
fix(analyzers): HIGH SC8 when skill ships __pycache__ or .pyc (#357)
nedlir commentedon Aug 12, 2026
The patch is incomplete, it deals only with pycache, but as an attacker I could exploit any of the other skipped files beacuse they are not being checked as needed. I opened another ticket #367