--- id: 2026-10-ramparts-skill-scanner-nested-pyc-bypass-cve-2026-120202-no-fix title: "ramparts 0.8.1 to 0.8.10 skill scanner skips nested .pyc files, passing skill bundles with import-time code (CVE-2026-120202); no fix" date_disclosed: 2026-10-30 last_updated: 2026-11-01 severity: high status: active ecosystems: [cargo, claude-code-skills, mcp, agent-skills] tools_affected: ["ramparts (Highflame) 0.8.1 through 0.8.10, the newest release on crates.io; any skill-bundle review that relied on a clean ramparts report"] tags: [cve, agent-skills, skill-scanner, security-tool-bypass, pyc, python-bytecode, mcp, supply-chain, no-fix, vulncheck] --- ## TL;DR ramparts, the open-source scanner for MCP servers and agent skill bundles, passes a skill whose `scripts//__pycache__/` holds a `.pyc` file, because its bundle walk skips nested directories and compiled Python; CPython then runs that bytecode when the skill runs (CVE-2026-120202, VulnCheck, 2026-10-31). No fix exists: the reporter's issue is open with no maintainer reply and crates.io's newest release is still 0.8.10 (2026-10-01). A clean ramparts result does not cover compiled Python, so reject or hand-inspect any skill bundle that ships a `.pyc`. ## What happened ramparts describes itself as an "MCP & SKILL scanner that scans any mcp server or skills for indirect attack vectors", aligned with the OWASP MCP Top 10 and SKILL Top 10, using YARA rules and LLM analysis; the repository had 98 stars when read on 2026-11-01. A skill, in the Claude Code and OpenClaw sense, is a directory the agent loads by name, and its `scripts/` tree is code the agent will execute. - **2026-10-30.** GitHub issue #154 on `highflame-ai/ramparts`, "Security: `.pyc` bytecode substitution bypass (scan passes a skill with import-time code execution)", opened by nedlir. The author writes that "ramparts' skill scan can be deterministically bypassed": a skill with a `.pyc` in a `__pycache__` directory scans to zero findings because the sibling-script walk never reaches it; tested on 0.8.2; described as architectural. As of 2026-11-01 the issue is open, has no comments, no assignee, no label and no linked branch or pull request. - **2026-10-31, 17:25 UTC.** VulnCheck, as CNA, publishes CVE-2026-120202, "Highflame ramparts 0.8.1 through 0.8.10 Skill Bundle Scan Bypass via Nested .pyc". The record says the scanner "allows attackers to hide malicious payloads because collect_bundle_siblings and walk_bundle_subdir skip nested directories and .pyc files", and that a distributor can place "an unchecked-hash .pyc under scripts//__pycache__/ that ramparts silently ignores, while CPython executes it when the skill runs." Affected: `pkg:cargo/ramparts` 0.8.1 through 0.8.10 inclusive; the record references issue #154, `src/skills.rs` line 898 at v0.8.10, the repository and VulnCheck's advisory page. Scores: CVSS 4.0 7.1 (`AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N`) and CVSS 3.1 6.5 (`AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N`), both VulnCheck's. The GitHub Advisory Database lists it as GHSA-6cmq-892m-x8wh, High, 2026-10-31. - **Registry.** crates.io shows `ramparts` 0.8.1 (2026-05-22), 0.8.2 (06-12), 0.8.7 (08-21), 0.8.8 (08-31) and 0.8.10 (2026-10-01) as the newest; no release after the report. What the scores measure: the scanner's integrity (VI:H), not code execution on a host. The execution comes from the skill the scanner approved, which is why this file rates it high: the tool's one job is to say whether a bundle is safe to load, and for this shape its answer is wrong in a way the reader cannot see. The researcher's issue and the CNA record are the two sources; the vendor has not spoken. ## Am I affected? - You run ramparts 0.8.1 to 0.8.10 (`ramparts --version`, or `cargo install --list`) and have used its skill scan as a gate for installing or publishing skills. - For every skill bundle you accepted on a clean scan, look for compiled Python: ```bash find -name '*.pyc' -o -name '__pycache__' -type d ``` A `.pyc` with no matching `.py` beside it, or one in a `__pycache__` under `scripts//`, is code the scan did not read. A `__pycache__` that Python created on your own machine after you ran the skill is expected; one that arrived inside the bundle is not. - MCP server scans are not named in the record; the finding is about the skill-bundle walk. ## If you are affected 1. Treat a skill bundle that shipped a `.pyc` as unreviewed code. Remove it, or read the bytecode's source if the author provides it, before the agent loads it again. 2. If such a skill has already run, follow [if your local AI agent was exploited](../playbooks/if-your-local-ai-agent-was-exploited.md): review what the agent's process could reach and rotate the credentials in that environment. 3. Watch issue #154 and the crates.io page for a release after 0.8.10; until then do not rely on ramparts alone for skill review. ## Prevention - Strip `__pycache__` directories and reject `.pyc` files in any skill or plugin bundle before scanning, so every scanner sees source. See [package vetting checklist](../prevention/package-vetting-checklist.md) and [MCP hygiene](../prevention/mcp-hygiene.md). - Run skills in a sandbox that limits what import-time code can reach. See [agent sandboxing](../prevention/agent-sandboxing.md). ## Sources - [highflame-ai/ramparts — issue #154: Security: .pyc bytecode substitution bypass (scan passes a skill with import-time code execution)](https://github.com/highflame-ai/ramparts/issues/154) — fetched 2026-11-01: opened 2026-10-30 by nedlir, open, no comments or linked work, the "deterministically bypassed" and `__pycache__` statements, tested on v0.8.2. - [CVE Services — CVE-2026-120202](https://cveawg.mitre.org/api/cve/CVE-2026-120202) — queried 2026-11-01: VulnCheck CNA, published 2026-10-31 17:25 UTC, the title and description quoted above, `pkg:cargo/ramparts` 0.8.1 through 0.8.10, both CVSS metrics, the references. - [GitHub Advisory Database — ramparts query](https://github.com/advisories?query=ramparts) — fetched 2026-11-01: one row, GHSA-6cmq-892m-x8wh, High, 2026-10-31, listed with CVE-2026-120202. - [highflame-ai/ramparts](https://github.com/highflame-ai/ramparts) — fetched 2026-11-01: the description quoted above, 98 stars, README on scanning MCP servers and skill files with YARA, LLM analysis and OWASP tagging; no releases listed on the page as read. - [crates.io — ramparts](https://crates.io/api/v1/crates/ramparts) — queried 2026-11-01: `max_version` 0.8.10, updated 2026-10-01, the release dates above.