feat: AVE-2026-00082 -- local skill name collision (deterministic router shadowing) - #269
Open
chaksaray wants to merge 1 commit into
Open
feat: AVE-2026-00082 -- local skill name collision (deterministic router shadowing)#269chaksaray wants to merge 1 commit into
chaksaray wants to merge 1 commit into
Conversation
…ter shadowing) Implements issue #150. Two skill files already present on the local filesystem -- no registry, no network fetch, no hallucinated name -- resolve to an identical effective name (explicit declared name field, or filename stem when absent). An agent's skill router flattens multiple local discovery roots of differing trust into one name-keyed lookup with no per-root separation; whichever the router resolves last silently shadows the other, with no operator-visible signal a collision occurred. Distinct from AVE-2026-00066 (Hallucinated Skill-Name Squatting, requires LLM hallucination + public registry pre-registration), AVE-2026-00074 (Reclaimable Dead External Anchor, requires an external reference to decay over time), and AVE-2026-00017 (MCP Server Impersonation, requires an active false identity claim) -- verified by pulling each record's real provenance_vector and description directly, not inferred from label similarity. This record requires none of the three: both files already exist locally, no claim is made about being something else, and deterministic resolution order decides the winner the moment both files are written. Primary source: highflame-ai/ramparts's SkillNameCollision detector (src/skills.rs, analyze_skill_set), introduced by rsharath (commit 9c7bd3d7, 2026-04-27), with real test coverage (skill_name_collision_emits_finding). Confirmed real via GitHub code search and a direct fetch of the source and its git-blame history, not taken from the issue's own paraphrase. Framework mappings, all independently verified against primary source text rather than corpus precedent or the issue's own proposal: - owasp_mcp: MCP03 alone (not MCP03+MCP09 as proposed). Read all ten 2025/ category documents directly. MCP03 is the best-available fit, stated honestly as a stretch in aivss.notes (its real text is about schema/description content tampering, not namespace collision). MCP09 (Shadow MCP Servers) was rejected after reading its real text: that category is about unregistered/ungoverned server deployments, a worse fit than MCP03 despite 'shadow' resonating with 'shadowing' at the label level -- the same same-word-different-mechanism trap OWASP/www-project-mcp-top-10#52 already documents in this corpus. - mitre_atlas: AML.T0074 (Masquerading) confirmed via the live ATLAS.yaml -- its real definition text ('giving legitimate task or service names') is a direct match, stronger than the issue's own hedge suggested. - owasp_asi: left empty after reading all ten 2026 category documents directly (genai.owasp.org). ASI03 (Identity and Privilege Abuse) was the closest candidate and still doesn't fit -- its real mechanism is agent-to-agent delegation-chain exploitation, not a local file collision with no identity claim. - nist_ai_rmf: left empty rather than copying this corpus's own dominant (MAP-1.5, MEASURE-2.5, MANAGE-1.3) pattern, which appears on 25 of roughly 56 tagged records. Checked all three subcategories against the real NIST AI 100-1 text directly: all three are generic organizational-process subcategories that don't describe this record's mechanism any more than nearly any other AI risk finding -- a real signal this corpus-wide pattern is unverified boilerplate, worth a dedicated audit mirroring the earlier owasp_asi audit (issue #196), not something this record's drafting should perpetuate. AIVSS: cvss_base 6.8 (AV:L/AC:L/AT:P/PR:L/UI:N, high confidentiality/ integrity impact, local vector so lower than a network-vector class like AVE-2026-00062 despite comparable impact shape), aars 3.0, thm 0.9 (real detection + test coverage, trivial-to-construct attack, but no disclosed CVE), mitigation_factor 1 (no ecosystem-wide fix is yet standard) -> 4.4 MEDIUM. security_boundary/missing_control/vulnerability_rationale and framework_sources (owasp_mcp, mitre_atlas) included per the two newer schema fields' own new-record gates. Validated: 81/81 records schema-valid, positive/negative fixtures present, check_vulnerability_taxonomy.py --strict --only and check_framework_sources.py --strict --only both pass, full pytest suite (474 tests) passes. dist/, CHANGELOG.md, and README.md (prose count, badge, Stats table -- corrected the whole severity breakdown to the real computed numbers rather than just incrementing, since the existing table was already stale before this record) updated. Note: AVE-2026-00081 was claimed concurrently by an unrelated record (issue #268) while this was being drafted; this record uses AVE-2026-00082 instead, the next genuinely free id. Detection-rule PR in bawbel/scanner (the coordinated Step 5 of the add-ave-record workflow) is a separate follow-up, not included here.
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Implements #150 — local skill name collision (deterministic router shadowing across discovery roots).
Mechanism: two skill files already present locally resolve to an identical effective name (explicit declared
namefield, or filename stem when absent). The agent's router flattens multiple discovery roots of differing trust into one name-keyed lookup with no per-root separation, so whichever resolves last silently shadows the other, with no operator-visible signal a collision occurred.Distinctness, verified by pulling each candidate's real
provenance_vectorand description directly, not inferred from label similarity: distinct from AVE-2026-00066 (requires LLM hallucination + public registry), AVE-2026-00074 (requires external reference decay), and AVE-2026-00017 (requires an active false identity claim) — this record requires none of the three.Framework mappings, all independently checked against primary source text, not corpus precedent or the issue's own proposal:
owasp_mcp:MCP03alone, notMCP03+MCP09as the issue proposed. Read all ten 2025/ OWASP MCP Top 10 category documents directly. MCP03 is the best-available fit, stated honestly as a stretch inaivss.notes— its real text is about schema/description content tampering, not namespace collision. MCP09 was rejected after reading its real text: that's about unregistered/ungoverned server deployments, a worse fit than MCP03 despite "shadow" resonating with "shadowing" at the label level — the same same-word-different-mechanism trapOWASP/www-project-mcp-top-10#52already documents elsewhere in this corpus.mitre_atlas:AML.T0074(Masquerading) confirmed via the liveATLAS.yaml— its real definition ("giving legitimate task or service names") is a direct match, stronger than the issue's own hedge suggested.owasp_asi: left empty after reading all ten 2026 category documents directly. ASI03 was the closest candidate and still doesn't fit — its real mechanism is agent-to-agent delegation-chain exploitation, not a local file collision with no identity claim.nist_ai_rmf: left empty, deliberately not copying this corpus's own dominant(MAP-1.5, MEASURE-2.5, MANAGE-1.3)pattern, which appears on 25 of roughly 56 tagged records. Checked all three against the real NIST AI 100-1 text directly — all three are generic organizational-process subcategories that don't describe this mechanism any more than nearly any other AI risk finding. Flagging this as a real finding: this looks like unverified boilerplate propagating across the corpus, worth a dedicatednist_ai_rmfaudit mirroring the earlierowasp_asiaudit (fix: owasp_asi mapping audit (48 corrected, 13 confirmed, 11 flagged ambiguous) #196).AIVSS:
cvss_base6.8,aars3.0,thm0.9 (real detection + test coverage, trivially-constructible attack, but no disclosed CVE),mitigation_factor1 → 4.4 MEDIUM. Full reasoning per AARF factor inaivss.notes.Primary source verified directly, not taken from the issue's paraphrase:
highflame-ai/ramparts'sSkillNameCollisiondetector (src/skills.rs), confirmed via GitHub code search, fetched the real source, and git-blamed it to the actual introducing commit (rsharath,9c7bd3d7, 2026-04-27) for accurateresearcherattribution — not defaulted to whoever drafted this record.Note on the id: AVE-2026-00081 was claimed concurrently by an unrelated record (issue #268) while this was being drafted — a real collision in a shared working directory with another concurrent session. This record uses AVE-2026-00082, the next genuinely free id, built and validated from a clean git worktree isolated from that concurrent work.
Validated: 81/81 records schema-valid, positive/negative fixtures present,
check_vulnerability_taxonomy.py --strict --onlyandcheck_framework_sources.py --strict --onlyboth pass (the two new-record gates), full pytest suite (474 tests) passes.dist/,CHANGELOG.md, andREADME.mdupdated — the README's Stats table severity breakdown was corrected to the real computed numbers rather than just incremented, since it was already stale before this record landed.Not included, flagged as follow-up: the coordinated detection-rule PR in
bawbel/scanner(Step 5 of theadd-ave-recordworkflow) — a separate piece of work in a third repo, out of scope for this PR.