Docs trigger pre-prompt detector

Medium Severity

The !… pre-prompt regex scans all of `SKILL.md`, so documenting the attack syntax (e.g. the `!`command bullet on line 109) is reported as a high-severity “Pre-prompt Command” even though no shell runs at load time.

• .agents/skills/skill-scanner/SKILL.md#L108-L109

 

Reviewed by Cursor Bugbot for commit 95f285d. Configure here.

Duplicate test-file scan findings

Low Severity

Test auto-discovery loops over every test_patterns entry without stopping after a match, so one Python file can match both test_*.py and *_test.py and emit two separate high-severity findings for the same path.

 

Reviewed by Cursor Bugbot for commit 95f285d. Configure here.

Incorrect iTXt PNG metadata parse

Medium Severity

iTXt chunks are parsed by splitting on null bytes only, but the PNG spec places one-byte compression flag and method between fields without null separators, so parts[4] often is not the text payload and metadata findings can be wrong or missed.

 

Reviewed by Cursor Bugbot for commit 95f285d. Configure here.

Bug: The code incorrectly parses PNG iTXt chunks by splitting on null bytes. It misinterprets the fixed-size comprFlag and comprMethod fields as null-terminated, leading to incorrect metadata extraction.
Severity: HIGH

The fix requires parsing the iTXt chunk according to its specification instead of relying on split. First, find the keyword by splitting on the first null byte. Then, read the next two bytes directly for comprFlag and comprMethod. The remaining data can then be split on the remaining null bytes to correctly extract the language tag, translated keyword, and the final text content.

Review the code at the location below. A potential bug has been identified by an AI
agent. Verify if this is a real issue. If it is, propose a fix; if not, explain why it's
not valid.

Location: .agents/skills/skill-scanner/scripts/scan_skill.py#L496-L501

Potential issue: The PNG `iTXt` chunk parser at `scan_skill.py:496` incorrectly assumes
all fields are null-terminated. The PNG specification defines `comprFlag` and
`comprMethod` as single-byte binary fields, not null-terminated strings. The current
implementation uses `chunk_data.split(b"\x00", 4)`, which fails for uncompressed chunks
(the common case) where `comprFlag` is `0x00`. This creates an extra empty part in the
split result, causing the code to incorrectly identify the translated keyword as the
text content and miss the actual text. Consequently, the scanner will fail to detect
malicious text in the most common type of PNG text metadata.

Did we get this right? 👍 / 👎 to inform future reviews.

Unhandled OSError in symlink section can abort the entire scan

If path.readlink() or path.resolve() raises an OSError (e.g. a permission-denied error on a symlink in a restricted directory), the exception propagates unhandled through this call and crashes scan_skill, returning no findings at all. Wrap the symlink loop body in a try/except OSError like the PNG and package.json sections already do.

• check_structural_attacks at line 380 loops over skill_dir.rglob("*") and calls path.readlink() and path.resolve() with no surrounding try/except.
• Both Path.readlink() and Path.resolve() can raise OSError (e.g. EACCES, EIO).
• The PNG section (lines 479–518) and package.json section each wrap their I/O in try/except (OSError, ...), but the symlink section has no equivalent guard.
• An unhandled exception propagates through the call at line 601 (all_findings.extend(check_structural_attacks(...))) and exits scan_skill with an uncaught exception, discarding all findings gathered so far.

Identified by Warden code-review · 342-AW8

rglob("*") in check_structural_attacks() follows directory symlinks on Python <3.13, enabling filesystem-traversal DoS against the scanner

check_structural_attacks() enumerates the skill directory with skill_dir.rglob("*") (symlink scan, test-file scan) and skill_dir.rglob("*.png") (PNG scan) without disabling symlink following. On Python 3.9–3.12 (the script declares requires-python = ">=3.9"), pathlib.Path.rglob descends into directory symlinks, so a malicious skill containing a single directory symlink to / (or ~) makes the scanner enumerate and, for the PNG branch, read arbitrary files across the whole filesystem — the very class of attack the symlink check was added to catch. A circular symlink can additionally trigger runaway recursion/resource exhaustion. The is_symlink() guard at the top of the loop only fires after rglob has already begun descending into the symlinked subtree, so it does not prevent the traversal.

• check_structural_attacks() (def at line 380) calls skill_dir.rglob("*") at lines 385 and 437 and skill_dir.rglob("*.png") at line 475, none passing follow_symlinks=False.
• The script header declares requires-python = ">=3.9"; pathlib.Path.rglob's follow_symlinks parameter was only added in Python 3.13, and on 3.9–3.12 ** recursion follows directory symlinks, so a directory symlink to / causes full-filesystem enumeration.
• The if path.is_symlink() check at line 386 emits a finding for the symlink entry but runs during iteration, after rglob has already started descending into the linked tree, so it cannot stop the traversal.
• The PNG branch (line 475) calls img_path.read_bytes() on every *.png reached via traversal, so a symlinked subtree lets it read PNGs outside the skill directory and surface their metadata in findings.
• Fix: iterate with os.walk(skill_dir, followlinks=False) (or guard each rglob result by skipping when an ancestor is a symlink), instead of relying on rglob's symlink-following default.

Identified by Warden find-bugs · ZTP-EUB