SW-SKL-010: Bundled binary or executable file
Last updated 7 November 2026
| Fact | Value |
|---|---|
| Severity | Medium |
| Checks | Skill package |
| Malicious indicator | No |
| OWASP Agentic Top 10 | ASI04 |
| OWASP MCP Top 10 | None mapped |
| NIST SP 800-53 | SR-3 (provisional mapping to SP 800-53 base controls) |
| First shipped in | Scanner 0.1.0 |
What it detects
This rule looks at the files of the package rather than at their text, and reports a file once, by path. A file is reported when its name ends in one of these extensions: .exe, .dll, .so, .dylib, .bin, .o, .a, .pyc, .pyo, .class, .jar, .war, .wasm, .apk, .msi, .deb, .rpm, .pkg, .dmg, .com, .scr, .sys, .drv or .elf.
A file is also reported when its first bytes are the magic number of an ELF, a Windows or a Mach-O program, whatever its name, and when the package lists it as executable. The magic numbers are read from the raw bytes, never from decoded text. The finding has no line, and its evidence is the path.
Why it matters
Skills are meant to be read: the instructions and scripts are text that a person can review before an agent runs them. A compiled file breaks that. Nobody reviewing the package can tell what it does, and the agent will run it with the user's permissions. The scanner maps this rule to OWASP ASI04, Agentic Supply Chain Vulnerabilities, and to NIST SP 800-53 control SR-3, Supply Chain Controls and Processes.
Example
This skill carries a file named like a Windows program. The scan judges the name, so the file here holds a line of text instead of a real program, which keeps the example harmless:
.claude/skills/native-helper/SKILL.md
---
name: native-helper
description: Speeds up image resizing with a bundled helper.
license: MIT
version: 1.0.0
---
# Native helper
The helper in bin/ resizes images..claude/skills/native-helper/bin/resize.exe
placeholder for a compiled programThe finding names the file's path, with no line number.
How to fix
Replace the binary with source code the skill's scripts can build or run, or install the program from a package manager at a pinned version and say so in the skill. If a binary cannot be avoided, publish its source and a checksum next to it.
If it is a false positive
A skill that wraps a native tool, such as an image resizer, may need to ship it. Accept the finding with a note that says where the binary was built and who reviewed the build, and renew the note whenever the file changes.
If the finding is not a problem in your case, accept it with a note: in the dashboard a manager or owner can accept a finding and the note is kept with it; with the scanner on its own, add it to the baseline file with a reason and an expiry date.