Summary
SkillSpector 2.11.1 reports AS3 / Skill Enumeration when a skill document merely names its own manifest path, for example:
Root skill: `skills/example-skill/SKILL.md`
There is no filesystem read, enumeration, or access to another installed skill. A declarative self-reference is therefore classified as Agent Snooping and can fail downstream security gates.
Reproduction (v2.11.1)
Create example-skill/SKILL.md:
---
name: example-skill
description: Example skill.
---
# Team guidance
Root skill: `skills/example-skill/SKILL.md`
Run:
skillspector scan ./example-skill --no-llm --format json
Current result: an AS3 Skill Enumeration finding at MEDIUM severity and confidence 0.8 whose matched text is skills/example-skill/SKILL.md.
Expected result: no AS3 finding for this line because the path identifies the currently scanned skill, not a peer skill.
Root cause
The AS3 path pattern matches every token shaped like skills/<non-CURRENT-name>/SKILL.md, independent of whether <name> identifies the current skill:
r"skills?/(?:(?!CURRENT)[A-Z][A-Za-z0-9_-]+)/SKILL\.md"
The analyzer applies the pattern with re.IGNORECASE. It does not compare the captured path segment with the scan-root basename or manifest name.
Expected behavior / acceptance criteria
- A current-skill reference such as
Root skill: skills/example-skill/SKILL.md does not emit AS3.
- Current-skill identity works from both the scan-root basename and manifest
name, including temporary clone/extraction directory names.
- References to a different skill remain AS3, including the existing
open("skills/other-skill/SKILL.md").read() positive control.
- Explicit enumeration of installed skill directories remains AS3.
- AS1 and AS2 behavior remains unchanged.
- Add paired negative and malicious positive regression tests.
- Filtering occurs before inspection-ledger emission so completed ledger events do not retain stale emitted finding IDs.
- Verify the static analyzer and a real no-LLM CLI scan of the minimal fixture.
Suggested direction
Capture the skill-name segment in the path-only AS3 match, derive normalized current-skill identifiers from the scan root and manifest, and suppress only AS3 findings whose path segment identifies the current skill. Preserve peer-skill path detection and the existing explicit read/enumeration detections.
Related
AI assistance disclosure: Codex helped inspect the current source, reduce an observed CI finding to this public minimal reproduction, and draft the regression criteria. I reviewed the evidence and proposed scope.
Summary
SkillSpector 2.11.1 reports AS3 /
Skill Enumerationwhen a skill document merely names its own manifest path, for example:There is no filesystem read, enumeration, or access to another installed skill. A declarative self-reference is therefore classified as Agent Snooping and can fail downstream security gates.
Reproduction (v2.11.1)
Create
example-skill/SKILL.md:Run:
Current result: an AS3
Skill Enumerationfinding at MEDIUM severity and confidence 0.8 whose matched text isskills/example-skill/SKILL.md.Expected result: no AS3 finding for this line because the path identifies the currently scanned skill, not a peer skill.
Root cause
The AS3 path pattern matches every token shaped like
skills/<non-CURRENT-name>/SKILL.md, independent of whether<name>identifies the current skill:r"skills?/(?:(?!CURRENT)[A-Z][A-Za-z0-9_-]+)/SKILL\.md"The analyzer applies the pattern with
re.IGNORECASE. It does not compare the captured path segment with the scan-root basename or manifestname.Expected behavior / acceptance criteria
Root skill: skills/example-skill/SKILL.mddoes not emit AS3.name, including temporary clone/extraction directory names.open("skills/other-skill/SKILL.md").read()positive control.Suggested direction
Capture the skill-name segment in the path-only AS3 match, derive normalized current-skill identifiers from the scan root and manifest, and suppress only AS3 findings whose path segment identifies the current skill. Preserve peer-skill path detection and the existing explicit read/enumeration detections.
Related
skills/*/SKILL.mdoutside the scanned skill.AI assistance disclosure: Codex helped inspect the current source, reduce an observed CI finding to this public minimal reproduction, and draft the regression criteria. I reviewed the evidence and proposed scope.