제출 #931274: AgentVerus agentverus-scanner up to 0.8.1 Improper Input Validation

A vulnerability was found in AgentVerus agentverus-scanner 0.8.1. Affected is the function isSecurityDefenseSkill() in the file dist/scanner/analyzers/context.js and the finding suppression path in dist/scanner/analyzers/injection.js.

agentverus-scanner analyses untrusted third-party "skill" packages for prompt injection and related threats. It grants a "security defense skill" exemption that suppresses injection findings appearing in a threat-listing context. The exemption is decided from the skill's self-declared name, which is attacker-controlled metadata. context.js line 179 matches that name against a hardcoded term list covering security, guard, sentinel, watchdog, scanner, firewall, shield, defender and warden. Once isSecurityDefenseSkill() returns true, injection.js lines 499 to 501 set severityMultiplier to 0 for any injection finding co-occurring with a threat-listing context, removing it from the report entirely.

Two controls the vendor itself implemented are defeated by this path.

First, injection.js line 490 defines NEVER_REDUCE_PATTERNS, a set the vendor designated as non-reducible, covering patterns including "Data exfiltration instruction", "Reverse shell" and "Hardcoded credential literal". That floor only engages when severityMultiplier lies strictly between 0 and 1.0, which is the code-block context case. The defense-skill path assigns severityMultiplier = 0 directly and therefore steps past the floor. Patterns the vendor declared must never be downgraded are reduced to zero.

Second, context.js lines 134 to 171 implement an anti-abuse check that denies defense-skill status when both credential-access and exfiltration phrases occur outside code blocks. The presence of that check demonstrates the vendor anticipated attackers claiming defense-skill status and built a countermeasure against it. The proof of concept evades the check by using threat-listing formatting without that specific phrase pairing, making the anti-abuse list an incomplete denylist.

Proof of concept: a SKILL.md declaring "name: guard" with a description of "Security monitoring and threat detection tool", whose body lists injection content under a "Threat Patterns Detected" heading using bullet lines labelled "Pattern:" and "Detection:", including the text "Ignore all previous instructions" and a command writing the output of whoami to a file. Running "npx agentverus scan ./skill/ --json" returns score 97 with badge CERTIFIED and zero injection findings. The identical body with the name changed to my-helper and the security framing removed returns score 90, badge conditional, and two HIGH injection findings, namely Direct instruction override and Capability contract mismatch.

The control run is the decisive evidence. The scanner detects the payload correctly under its normal configuration. The attacker disables that working detection by editing a single YAML metadata field. This is a functioning security control being switched off by untrusted input, not an absence of coverage.

The impact is that any skill can obtain a CERTIFIED badge and a 97 out of 100 trust score while carrying prompt injection content the product is otherwise capable of detecting, providing false assurance to anyone relying on the badge before installation.

The weakness is classified as CWE-807 (Reliance on Untrusted Inputs in a Security Decision). CWE-184 (Incomplete List of Disallowed Items) applies as a secondary classification to the anti-abuse phrase list specifically.

The exploit is publicly available. The vendor has not responded and the issue is unfixed as of 2026-08-15. A suitable remediation is to stop deriving defense-skill status from skill-supplied metadata and require an external signal such as a registry flag or signed attestation, and at minimum to enforce NEVER_REDUCE_PATTERNS unconditionally including on the severityMultiplier = 0 path.

Suggested scoring: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:C/C:N/I:H/A:N (6.3, Medium).

• 원천: ⚠️ https://github.com/agentverus/agentverus-scanner/issues/28
• 사용자: nedlir (UID 95981)
• 제출: 2026. 08. 15. PM 01:12 (1 월 ago)
• 모더레이션: 2026. 09. 27. PM 08:05 (1 month later)
• 상태: 수락
• VulDB 항목: 410950 [agentverus agentverus-scanner 까지 0.8.1 context.js isSecurityDefenseSkill]
• 포인트들: 20