Security scanners legitimately reference dangerous patterns (eval, os.system,
subprocess shell=True, etc.) inside their own regex pattern definitions and
human-readable risk/fix descriptions. Auditing the auditor itself produced
17 CRITICAL false positives — all from its own pattern table. ship-gate had
the same issue (2 CRITICALs on a check description and a variable name
called eval_findings).
Fix:
- Add 'noqa: SEC-AUDITOR' / 'auditor:ignore-line' line-suppression directive
to all three scan loops (code patterns, prompt-injection markdown,
pip/npm runtime install detection).
- Annotate the 179 pattern-definition lines in skill_security_auditor.py
(regex, risk, fix entries) and 4 cleanup shutil.rmtree calls.
- Annotate ship-gate's two flagged lines (SEC-13 check description and
eval_findings variable usage).
- Annotate SKILL.md and references/threat-model.md tables that document
attack patterns for human readers (HTML comment <!-- noqa: SEC-AUDITOR -->).
Verified end-to-end:
skill-security-auditor self-audit: 17 CRITICAL -> 0 (PASS)
ship-gate self-audit: 2 CRITICAL -> 0 (PASS)
slo-architect: PASS (0/0)
project-management WARN unchanged (no top-level SKILL.md, expected)
PR #527 (@rx4u) submitted a pre-production audit skill that was based on the
pre-#593 layout (skills directly under engineering/). After #593 landed, the
diff would have undone the entire restructure (4500+ rename ops). Re-applying
the actual new content at the correct post-restructure path.
What landed:
- engineering/skills/ship-gate/SKILL.md
- engineering/skills/ship-gate/references/checks.md
- engineering/skills/ship-gate/references/patterns.md
- engineering/skills/ship-gate/scripts/ship_gate_scanner.py
Verified:
- python3 ship_gate_scanner.py --help → OK
- python3 ship_gate_scanner.py --version → ship-gate 1.0.0
- 1671 tests pass (was 1666; +5 for ship-gate smoke + integrity)
- engineering/.claude-plugin/plugin.json: 48 → 49 skills, v2.4.2 → v2.4.3
- marketplace.json: engineering-advanced-skills entry updated to match
Closes#527.
Co-authored-by: Rajaraman Arumugam <rx4u@users.noreply.github.com>
https://claude.ai/code/session_01Dq12xJakFRxwaoU8Pqejdm
