ramparts 0.8.1 to 0.8.10 skill scanner skips nested .pyc files, passing skill bundles with import-time code (CVE-2026-120202); no fix

View raw markdownEdit on GitHub ↗

TL;DR

ramparts, the open-source scanner for MCP servers and agent skill bundles, passes a skill whose scripts/<subdir>/__pycache__/ holds a .pyc file, because its bundle walk skips nested directories and compiled Python; CPython then runs that bytecode when the skill runs (CVE-2026-120202, VulnCheck, 2026-10-31). No fix exists: the reporter's issue is open with no maintainer reply and crates.io's newest release is still 0.8.10 (2026-10-01). A clean ramparts result does not cover compiled Python, so reject or hand-inspect any skill bundle that ships a .pyc.

What happened

ramparts describes itself as an "MCP & SKILL scanner that scans any mcp server or skills for indirect attack vectors", aligned with the OWASP MCP Top 10 and SKILL Top 10, using YARA rules and LLM analysis; the repository had 98 stars when read on 2026-11-01. A skill, in the Claude Code and OpenClaw sense, is a directory the agent loads by name, and its scripts/ tree is code the agent will execute.

  • 2026-10-30. GitHub issue #154 on highflame-ai/ramparts, "Security: .pyc bytecode substitution bypass (scan passes a skill with import-time code execution)", opened by nedlir. The author writes that "ramparts' skill scan can be deterministically bypassed": a skill with a .pyc in a __pycache__ directory scans to zero findings because the sibling-script walk never reaches it; tested on 0.8.2; described as architectural. As of 2026-11-01 the issue is open, has no comments, no assignee, no label and no linked branch or pull request.
  • 2026-10-31, 17:25 UTC. VulnCheck, as CNA, publishes CVE-2026-120202, "Highflame ramparts 0.8.1 through 0.8.10 Skill Bundle Scan Bypass via Nested .pyc". The record says the scanner "allows attackers to hide malicious payloads because collect_bundle_siblings and walk_bundle_subdir skip nested directories and .pyc files", and that a distributor can place "an unchecked-hash .pyc under scripts//pycache/ that ramparts silently ignores, while CPython executes it when the skill runs." Affected: pkg:cargo/ramparts 0.8.1 through 0.8.10 inclusive; the record references issue #154, src/skills.rs line 898 at v0.8.10, the repository and VulnCheck's advisory page. Scores: CVSS 4.0 7.1 (AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N) and CVSS 3.1 6.5 (AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N), both VulnCheck's. The GitHub Advisory Database lists it as GHSA-6cmq-892m-x8wh, High, 2026-10-31.
  • Registry. crates.io shows ramparts 0.8.1 (2026-05-22), 0.8.2 (06-12), 0.8.7 (08-21), 0.8.8 (08-31) and 0.8.10 (2026-10-01) as the newest; no release after the report.

What the scores measure: the scanner's integrity (VI:H), not code execution on a host. The execution comes from the skill the scanner approved, which is why this file rates it high: the tool's one job is to say whether a bundle is safe to load, and for this shape its answer is wrong in a way the reader cannot see. The researcher's issue and the CNA record are the two sources; the vendor has not spoken.

Am I affected?

  • You run ramparts 0.8.1 to 0.8.10 (ramparts --version, or cargo install --list) and have used its skill scan as a gate for installing or publishing skills.
  • For every skill bundle you accepted on a clean scan, look for compiled Python:
find <skill-dir> -name '*.pyc' -o -name '__pycache__' -type d

A .pyc with no matching .py beside it, or one in a __pycache__ under scripts/<subdir>/, is code the scan did not read. A __pycache__ that Python created on your own machine after you ran the skill is expected; one that arrived inside the bundle is not. - MCP server scans are not named in the record; the finding is about the skill-bundle walk.

If you are affected

  1. Treat a skill bundle that shipped a .pyc as unreviewed code. Remove it, or read the bytecode's source if the author provides it, before the agent loads it again.
  2. If such a skill has already run, follow if your local AI agent was exploited: review what the agent's process could reach and rotate the credentials in that environment.
  3. Watch issue #154 and the crates.io page for a release after 0.8.10; until then do not rely on ramparts alone for skill review.

Prevention

  • Strip __pycache__ directories and reject .pyc files in any skill or plugin bundle before scanning, so every scanner sees source. See package vetting checklist and MCP hygiene.
  • Run skills in a sandbox that limits what import-time code can reach. See agent sandboxing.

Sources