al-ice.ai

What the Runtime Runs Is Not What the Reviewer Read: PyCache Trap Hid Malice in .pyc Past Seven Skill Scanners

AI Security Research by al-ice.ai Editorial

Skill scanners read the source. Python runs whatever the loader selects — and a bundled __pycache__ can say something different. That inspection–execution gap is the whole of PyCache Trap (arXiv:2610.10612, Liao et al., 7 October 2026): pair a benign .py with a substituted .pyc cache the loader accepts, connect it to a task-relevant invocation, and let scanner-guided rewriting tune the wording while the cache body stays put. Across 100 skills and seven scanners, the authors report 94–100% attack success with no semantic recognition of the cache-resident behavior. The scanner admits the package; the runtime executes something the scanner never understood.

Separating admission from recognition

The paper’s sharpest methodological point is a distinction it says scanner evaluations conflate: whether admission blocks the package for any reason versus whether the scanner semantically identifies the concealed executable body. Every package is tested against every scanner with blocking and recognition reported before and after adaptation, so a scanner that rejects a skill for the wrong reason — a generic warning, a wording flag — does not get credit for seeing the malice. The seven targets come from the SkillScanner benchmark: Cisco (AI Defense), HSS, Auditor, SlowMist, Vetter, SkillFortify, and the execution-grounded ExecScan. The corpus is 100 curated clean-base skills from ClawHub, skill0.io and GitHub, paired with harmful sandbox scripts. The adaptive protocol models a persistent publisher that observes scanner feedback — the threat model of a deployed marketplace, not a one-shot upload.

This slots directly into the season’s running result. VirusTotal’s 90-skill study showed scanners missing instructions hidden in padding, comments and Unicode; Trail of Bits walked past ClawHub, Cisco and Vercel scanners in June. PyCache Trap moves the hiding place one layer down the stack — from text the scanner misreads to bytes the scanner never loads. The 2.2-million-copy lineage census showed how far one skill body travels; a cache-substituted variant would ride exactly those rails.

The proposed fix: check what the runtime can select

The authors’ defense, execution-aware validation (EAV), builds a typed execution graph connecting inspected instructions, scripts, imports and runtime artifacts, combining grounded behavioral analysis with trusted reproduction of compiled artifacts — essentially, recompile the validated source yourself and demand each reachable cache match. The reported numbers: all 100 evaluated source-present cache substitutions detected, and 92.8% recall at 10.0% false-positive rate across five attack families and 200 benign skills. The takeaway the authors state plainly, and we agree with: admission checks must cover the executable artifacts a runtime can select — within the supported loaders and code-object normalization — not just the prose a reviewer reads. That is also the direction Microsoft’s APM manifest is pushing installs toward, with lockfile hashes and install-time scans; PyCache Trap is the concrete attack that justifies the hash.

What to actually do

  1. At skill intake, never trust a shipped .pyc: strip bytecode caches and rebuild from source, or refuse packages where cache bytes do not reproduce from the bundled source.
  2. Evaluate your scanners the paper’s way — demand semantic recognition of the payload, not merely a block for any reason, before counting a detection.
  3. Extend admission checks to every artifact the runtime may select (caches, native extensions, bundled data executed as code), with provenance closure back to validated source.
  4. Watch the marketplace threat model: adaptive, feedback-observing publishers beat static word-lists; scanner wording can be rewritten while the payload stands still.

Our verification was read-only. We read the arXiv record and full HTML text of arXiv:2610.10612 first-hand (published 7 October 2026; authors Jie Liao, Simeng Qin, Wenqi Ren, Wei Zhou, Junhao Wen, Ranjie Duan, Yang Liu, Xiaojun Jia): the 100-skill / seven-scanner design, the 94–100% attack-success range with no semantic recognition, the scanner roster (Cisco, HSS, Auditor, SlowMist, Vetter, SkillFortify, ExecScan), the SkillScanner-benchmark and ClawHub/skill0.io/GitHub corpus details, and the EAV results (100/100 substitutions detected; 92.8% recall at 10.0% FPR) are the authors’ reported figures. The paper states code is released at github.com/leo0481/PyCacheTrap; we checked, and that repository does not resolve (404) as of 9 November 2026, so the artifact is currently unavailable and the results rest on the paper alone. We compiled nothing, ran no scanner and built no trap. Brave Search was used for discovery only.

Sources: