Ramparts: a .pyc file in a skill bundle slips past the scanner
Ramparts 0.8.1 through 0.8.10 marks a skill bundle as clean when its payload sits in a nested __pycache__ directory as Python bytecode.
· VulnCheck · Research by Liran Neduva
Ramparts, an open-source MCP and skill scanner, reports no findings on a skill bundle that hides Python bytecode in a nested __pycache__ directory, and CPython runs that bytecode when the skill runs. No fixed version is listed.
01What happened
Liran Neduva reported on October 30, 2026 that Ramparts, the open-source MCP and skill scanner from Highflame, can be bypassed deterministically. VulnCheck published CVE-2026-120202 for the bypass the next day with a CVSS 4.0 score of 7.1. The project issue is still open and records no reply from the maintainers.
02How it works
Ramparts walks a bundle's sibling scripts but skips entries that are not plain files, so a subdirectory under scripts/ is never opened, and its script extension allowlist leaves out .pyc. A payload shipped as bytecode under scripts/<subdir>/__pycache__/ therefore reaches no analyzer and the scan returns zero findings. Neduva compiled the file with PEP 552 unchecked-hash invalidation, and VulnCheck says CPython executes it when the skill runs. The advisory classes the weakness as CWE-693, protection mechanism failure.
03Who is affected
Teams that vet third-party agent skills with Ramparts 0.8.1 through 0.8.10 get the false assurance; the advisory names no fixed release. Highflame describes Ramparts as a Rust scanner for MCP servers and skills, aligned with the OWASP MCP and SKILL Top 10 lists.
04What to do
Treat a clean Ramparts verdict as incomplete until a fix ships: unpack skill bundles yourself, look for .pyc files and __pycache__ directories including inside subdirectories, and reject any bundle that ships bytecode without matching source. Follow project issue 154 for a patched release.
Sources 3 links, all fetched
- 1vulncheck.comVulnCheck Advisory
- 2github.comProject Issue 154
- 3github.comRamparts Repository