Description

Tencent AI-Infra-Guard's skill-scan component excludes compiled Python bytecode files from analysis by hardcoding __pycache__ directories and .pyc/.pyo/.pyd extensions into skip lists across multiple scanning surfaces. Attackers can distribute skills with benign Python source files alongside malicious compiled bytecode that executes on import while the scanner reports a safe verdict, enabling code execution when operators install the skill.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.5",
  "pubDate": "2026-09-02T17:18:05.150Z",
  "pubdate": "2026-09-02T17:18:05.150Z",
  "executiveSummary": "Tencent AI-Infra-Guard suffers from a security bypass vulnerability in its skill-scan component, stemming from an insecure file filtering mechanism.\nThe scanner is designed to evaluate Python-based skills for malicious content; however, it explicitly excludes compiled Python bytecode files from inspection.\nBy hardcoding '__pycache__' directories and .pyc, .pyo, and .pyd file extensions into global skip lists, the scanner fails to analyze these files during the integrity check process.\nThis flaw allows an attacker to distribute malicious skills containing a mix of benign source code and malicious compiled bytecode. When an operator installs such a skill, the AI-Infra-Guard reports a safe verdict, enabling the execution of arbitrary code upon import of the bytecode.\nThe vulnerability represents a critical risk as it effectively renders the scanner blind to malicious payloads concealed within bytecode formats, providing attackers a reliable vector for bypassing security analysis. Successful exploitation requires an attacker to successfully distribute a manipulated skill to a target operator, leading to potential system compromise or unauthorized code execution within the AI infrastructure environment.",
  "technicalDetails": "The root cause of this vulnerability lies in the implementation of a static exclusion policy within the skill-scan component of Tencent AI-Infra-Guard. The scan engine utilizes a blacklist/skip-list approach to optimize performance, which includes hardcoded directives to ignore directories named '__pycache__' and files carrying '.pyc', '.pyo', or '.pyd' extensions.\nThe attack flow begins with the creation of a weaponized skill package. An attacker embeds benign Python source files to pass superficial static analysis while simultaneously including malicious bytecode files (e.g., a compiled 'malicious.pyc' file) within the package structure. Because the scanning engine logic automatically skips these files, they are never subjected to signature matching, heuristics, or behavioral analysis.\nWhen an operator initiates the installation or deployment process, the AI-Infra-Guard performs its security check. Due to the configured skip-list, the scanner ignores the malicious bytecode while verifying the benign source files, ultimately returning a 'Safe' verdict to the operator.\nUpon installation, the AI-Infra-Guard or the target environment imports the skill modules. Python's runtime environment automatically loads and executes the malicious bytecode when the module is imported, triggering the payload. This execution occurs with the privileges of the service or operator running the AI-Infra-Guard component.\nThe failure occurs across multiple scanning surfaces, suggesting a global implementation of these exclusions within the scanning pipeline. Since the scanner does not evaluate the contents of the skipped bytecode files, it cannot detect the presence of malicious imports or injected logic intended to facilitate remote code execution (RCE) or persistence.\nThe post-exploitation impact is severe, as the attacker achieves code execution within the context of the AI-Infra-Guard service. From this position, an attacker could potentially access sensitive model data, escalate privileges, or pivot within the surrounding infrastructure. No specific authentication is required to trigger the vulnerability once the package is presented to the scanner, and the exploit is highly effective against systems relying exclusively on the AI-Infra-Guard's verdict for security assurance."
}