Repository navigation
E5 labels cloud-to-local downloads as cloud exfiltration #889
Description
E5 matches AWS/GCS transfer verbs without checking direction, so a cloud-to-local download is labeled Cloud Storage Exfiltration.
Reproduced with static-only scans of main 11c8b48e35056602fad263438448e0ffb5be2776. Put these inert examples in a skill's transfer.sh:
aws s3 cp s3://example-bucket/public.csv ./public.csv
aws s3 sync s3://example-bucket/public-data ./public-data
gsutil cp gs://example-bucket/public.csv ./public.csvRun skillspector scan ./skill --no-llm --format json --fail-on-findings. Each download receives MEDIUM E5 and the strict findings gate exits 1. JSON/SARIF agree, with successful execution and complete coverage. A five-occurrence download-only helper scores 13/LOW/SAFE under the existing default policy, so the default scan exits 0; the strict gate still fails. None of the example commands needs to be executed.
The AWS cp reference explicitly supports S3-to-local downloads. The E5 patterns match cp/sync/mv without examining operands, despite the rule's outbound-transfer description.
Proposed focused correction: exempt only individually proven, literal, non-destructive remote-to-local copies/syncs. Preserve actual uploads, remote-to-remote copies, stdin sources, moves, deletion-bearing syncs, dynamic/unknown operands, nested commands, later uploads and SDK upload rules. A safe outer operation must not conceal another upload occurrence.
Merged #218 originally added E5. Open #741 changes resource handling; #841 owns separate E1 command boundaries. These are related integration considerations rather than an existing E5 direction fix. Public examples here are independently synthesized.
Activity
CharmingGroot commentedon Oct 23, 2026
Thanks for picking this up, and for keeping the proof in #891 so careful. I added E5 a while back, so I was curious how downloads show up in real skills and ran it over NVIDIA/skills (
ad6987ab,--no-llm) on main and on #891.There are eight download matches, with the same results on main and #891:
aws s3 sync --no-sign-request "s3://..." "$USD_ASSET_ROOT/...", split over three lines)aws s3 sync "<output_directory>/<run_id>/anomaly_dataset/" /tmp/evg-results/)timeout 600 aws s3 cp s3://... .inside the eval prompt)They use a placeholder source, a
timeoutwrapper, or a quoted variable over several lines, so they're outside the literal cases #891 handles, which looks expected. Just leaving them here in case they're useful. If it makes sense to handle them in a separate issue, I'm happy to open one.