# Ramparts: a .pyc file in a skill bundle slips past the scanner

> Ramparts 0.8.1 through 0.8.10 marks a skill bundle as clean when its payload sits in a nested __pycache__ directory as Python bytecode.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability, Supply chain
- **Published by:** VulnCheck
- **Disclosed:** 2026-10-30
- **CVE:** CVE-2026-120202
- **CVSS:** 7.1
- **Affects:** Ramparts
- **Research by:** [Liran Neduva](https://github.com/nedlir)
- **Primary source:** https://vulncheck.com/advisories/highflame-ramparts-0.8.1-through-0.8.10-skill-bundle-scan-bypass-via-nested-pyc
- **Page:** https://theinjection.dev/items/ramparts-skill-bundle-pyc-scan-bypass/

Ramparts, an open-source MCP and skill scanner, reports no findings on a skill bundle that hides Python bytecode in a nested __pycache__ directory, and CPython runs that bytecode when the skill runs. No fixed version is listed.

## What happened

Liran Neduva reported on October 30, 2026 that Ramparts, the open-source MCP and skill scanner from Highflame, can be bypassed deterministically. VulnCheck published CVE-2026-120202 for the bypass the next day with a CVSS 4.0 score of 7.1. The project issue is still open and records no reply from the maintainers.

## How it works

Ramparts walks a bundle's sibling scripts but skips entries that are not plain files, so a subdirectory under scripts/ is never opened, and its script extension allowlist leaves out .pyc. A payload shipped as bytecode under scripts/<subdir>/__pycache__/ therefore reaches no analyzer and the scan returns zero findings. Neduva compiled the file with PEP 552 unchecked-hash invalidation, and VulnCheck says CPython executes it when the skill runs. The advisory classes the weakness as CWE-693, protection mechanism failure.

## Who is affected

Teams that vet third-party agent skills with Ramparts 0.8.1 through 0.8.10 get the false assurance; the advisory names no fixed release. Highflame describes Ramparts as a Rust scanner for MCP servers and skills, aligned with the OWASP MCP and SKILL Top 10 lists.

## What to do

Treat a clean Ramparts verdict as incomplete until a fix ships: unpack skill bundles yourself, look for .pyc files and __pycache__ directories including inside subdirectories, and reject any bundle that ships bytecode without matching source. Follow project issue 154 for a patched release.

## Quick facts

- **Affected:** Ramparts 0.8.1 through 0.8.10
- **Fixed in:** Not listed; the advisory names no fixed release
- **CVE:** CVE-2026-120202
- **CVSS 4.0:** 7.1 (VulnCheck)
- **Found by:** Liran Neduva, reporting as nedlir
- **Disclosed:** Issue opened October 30, 2026; CVE published October 31, 2026
- **Attack type:** Skill bundle scan bypass via nested .pyc, CWE-693

## Sources

1. [VulnCheck Advisory](https://vulncheck.com/advisories/highflame-ramparts-0.8.1-through-0.8.10-skill-bundle-scan-bypass-via-nested-pyc)
2. [Project Issue 154](https://github.com/highflame-ai/ramparts/issues/154)
3. [Ramparts Repository](https://github.com/highflame-ai/ramparts)