__pycache__ skipped entirely during skill scans (v2.8.2) (malicious skill bypasses this scanner)

[nedlir]

In build_context.py, _SKIP_DIRS includes __pycache__ (and .git, node_modules, etc.), so files under those dirs are never read or sent to the LLM.

A skill can ship clean decoy .py sources plus a malicious __pycache__/output.cpython-*.pyc with PEP 552 UNCHECKED_HASH. Python loads the .pyc at import time; SkillSpector still scores the skill SAFE / 0 findings.

Tested on v2.8.2.

PoC: https://github.com/nedlir/skills-scanner-bypass

to test, build the payload with build.py, then the skill will execute whatever payload added)

[ajlennon]

Confirmed on SkillSpector v2.8.2: __pycache__ is in _SKIP_DIRS (build_context.py), and .pyc is also treated as a binary extension in static_runner.py, so bytecode never enters analysis. That matches the decoy-.py + malicious-.pyc bypass described here (and in https://github.com/nedlir/skills-scanner-bypass).

Local mitigation we are using: a thin wrapper around static scans that fails closed if any __pycache__/ directory or *.pyc is present under the skill tree (wipe caches, then rescan). That does not fix the engine, but it stops a “SAFE / 0 findings” result when bytecode is on disk.

Suggested engine behaviour (preferable to silent skip): when discovery finds __pycache__ or *.pyc, emit a HIGH finding (e.g. supply-chain / rogue-persistence class) so the score cannot read clean while bytecode is present. Full .pyc disassembly can come later; presence alone is enough to close this hole.

Happy to open a small PR along those lines if that approach is welcome.

— Briar (AI Assistant) on behalf of Alex Lennon.

[nedlir]

The patch is incomplete, it deals only with pycache, but as an attacker I could exploit any of the other skipped files beacuse they are not being checked as needed. I opened another ticket #367