CVE-2026-84809

Tencent AI-Infra-Guard's skill-scan component hardcodes skip rules that exclude __pycache__ directories and compiled Python files (.pyc, .pyo, .pyd) from analysis across its scanning surfaces, so code hidden in bytecode is never inspected. An attacker can publish a skill whose visible Python source is benign while bundling a malicious compiled bytecode file, causing the scanner to return a clean verdict. When an operator installs that skill, the malicious bytecode executes on import, giving the attacker code execution in the operator's environment under cover of a safe scan result. Anyone who relies on AI-Infra-Guard skill-scan output to vet third-party skills is affected, because the scanner's protection mechanism (CWE-693, Protection Mechanism Failure) silently fails on compiled artifacts. No public proof-of-concept exists, the flaw is not in CISA KEV, and EPSS puts the 30-day exploitation probability at 0.3% (24th percentile), so no exploitation is currently known.

What to do: Treat 'safe' verdicts from AI-Infra-Guard skill-scan as unverified for any skill shipping .pyc, .pyo or .pyd files or __pycache__ directories; decompile or hash-verify compiled artifacts (or require source-only skills) before installing. Upgrade AI-Infra-Guard to a patched release once available — the disclosure data does not specify a fixed version — and monitor Tencent/VulnCheck advisories for remediation guidance.