An agent skill may include a harmless-looking SKILL.md and readable Python source while also carrying a bytecode cache that the Python loader can execute instead. PyCache Trap couples substituted compiled artifacts to plausible, task-relevant skill invocations so the code actually selected at runtime differs from the code a scanner reviewed. In tests across…
Inspect the ClaimsCase · DiggingBeagle record
PyCache Trap exposes a blind spot in agent skill scanners
PyCache Trap demonstrates that a benign-looking agent skill source can differ from cached Python bytecode executed by the loader. Seven scanners struggled in controlled tests, while execution-aware validation improved recognition. No marketplace infection or universal loader coverage was shown.
Scope
Controlled finding or reported disclosure as of 2026-10-09; Controlled scanner tests, no confirmed skill-marketplace infection.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade B
- Remediation
- mitigation available
- AI role
- AGAINST AI
Basis and provenance
Desk review of scoped canonical Claims, the pinned SRC-2026-CP3-PYCACHE-TRAP Source, and the publicly accessible primary disclosure. The classification applies to the documented setting and prerequisites only. Impact remains unbanded because real victim consequences are not established, and no independent reproduction is claimed. Details: The benchmark does not measure actual skill-marketplace compromise or production installer infection.
Assessed Oct 13, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-CP3-PYCACHE-TRAP-1 · CLM-CP3-PYCACHE-TRAP-2 · CLM-CP3-PYCACHE-TRAP-3 · PyCache Trap: hidden Python bytecode defeats source-only AI skill scanners
At a glance
Skill admission must bind reviewed text to the exact artifacts that can be executed. Checking SKILL.md and source files alone can miss imported bytecode even when the visible instructions appear benign.
Read the implicationsThe benchmark does not measure actual skill-marketplace compromise or production installer infection. Loader and bytecode compatibility differ by Python version and execution environment.
Limits and uncertaintyFull account
An agent skill may include a harmless-looking SKILL.md and readable Python source while also carrying a bytecode cache that the Python loader can execute instead. PyCache Trap couples substituted compiled artifacts to plausible, task-relevant skill invocations so the code actually selected at runtime differs from the code a scanner reviewed. In tests across 100 skills and seven static scanners, the authors report a 94% to 100% attack success range and no semantic recognition of the concealed cache behavior.
The proposed execution-aware validation (EAV) maps instructions, scripts, imports and executable artifacts into an execution graph, then checks compiled artifacts with trusted reproduction. It detected all 100 source-present cache substitutions in its narrow test and reported 92.8% recall at 10% false-positive rate across broader families with 200 benign skills. Loader selection rules and supported code-object normalization are important assumptions. The paper does not report a confirmed poisoned marketplace skill or real compromise.
Mechanism and trust boundary
- 01
Skill package
A third-party AI skill includes benign instructions and source code along with a substituted Python cache artifact.
Boundary: A third-party AI skill includes benign instructions and source code along with a substituted Python cache artifact.
- 02
Scanner mismatch
Source-only inspection examines the benign files while missing the executable artifact the loader may prefer.
Boundary: Source-only inspection examines the benign files while missing the executable artifact the loader may prefer.
- 03
Runtime selection
A task-relevant import or invocation selects the malicious cached bytecode inside the agent's execution environment.
Boundary: A task-relevant import or invocation selects the malicious cached bytecode inside the agent's execution environment.
Timeline
- Oct 9, 2026disclosure
Public disclosure
Claims & evidence
CLM-CP3-PYCACHE-TRAP-1The PyCache Trap researchers report 94% to 100% bypass success across 100 agent skills and seven scanners in their controlled experiments.supported
Basis: reported finding
- supportsPyCache Trap: hidden Python bytecode defeats source-only AI skill scannersprimary disclosure
Abstract, scanner-guided rewriting and evaluated skills
CLM-CP3-PYCACHE-TRAP-2Their execution-aware validation detected 100 of 100 source-present cache substitutions and reported 92.8% recall with 10% false-positive rate in expanded evaluation.supported
Basis: reported finding
- supportsPyCache Trap: hidden Python bytecode defeats source-only AI skill scannersprimary disclosure
Abstract, execution-aware validation results
CLM-CP3-PYCACHE-TRAP-3The EAV follow-up study reports 92.8% recall at a 10% false-positive rate across five attack families and 200 benign skills; it does not establish universal loader coverage.supported
Basis: reported finding
- supportsPyCache Trap: hidden Python bytecode defeats source-only AI skill scannersprimary disclosure
Abstract, expanded EAV evaluation
Implications
Skill admission must bind reviewed text to the exact artifacts that can be executed. Checking SKILL.md and source files alone can miss imported bytecode even when the visible instructions appear benign.
Controls and mitigations
- Inspect and integrity-check bytecode caches, binaries and importable artifacts alongside documented skill source.
- Recreate permitted compiled artifacts from reviewed source or discard untrusted caches under controlled loader rules.
- Test the actual execution graph and supported Python versions before claiming scan coverage.
Unknowns and contradictions
- The benchmark does not measure actual skill-marketplace compromise or production installer infection.
- Loader and bytecode compatibility differ by Python version and execution environment.
Sources and citation
Material revision history
- Oct 13, 2026 · Published version · first publication · revision 137