AI-Infra-Guard

Update main to include PR #674 (commit 51d63e2) and PR #677 (commit ff82482), then run:

git pull --ff-only
go build ./...
go test ./... -count=1

Those changes fix the stale references in common/agent/tasks_test.go (TestDemoAgent, BaseUrl, Token, Model), align the five common/websocket assertions with the returned English error messages, and make environment-dependent tests resolve paths from the repo root or skip when Chrome, the local 127.0.0.1:8265 service, or /mcp-server is unavailable. PR #677 also adds .github/workflows/go-test.yml, so CI now runs go build ./... and go test ./... -count=1 on pushes to main and pull requests.

If you cannot update immediately, either define or remove the stale test symbols in common/agent/tasks_test.go, and update the websocket test expectations to match the actual API response language instead of mixing English responses with Chinese expected strings.

The vulnerability occurs because aig-skill-scan unconditionally skips all scanning of directories defined in _TREE_SKIP_DIRS (including __pycache__, .git, node_modules, .venv, venv, dist, build, .next, .nuxt) for performance. Attackers can evade detection by placing malicious scripts in these directories and invoking them from legitimate Skill code (e.g. subprocess.run(["python", ".venv/hidden.py"])).
Remediation steps:
1. Do not treat directories in _TREE_SKIP_DIRS as fully trusted.
2. Retain the default behavior of skipping full recursive scans for these directories to preserve performance.
3. Add targeted detection logic: when the scanner identifies Skill code executing, importing, or loading files from skipped directories, either run an on-demand security scan on the referenced target file or trigger a risk alert immediately.

This affects AI-Infra-Guard v4.5.1. dir_tree and the static pre_scan pass exclude __pycache__ and .pyc/.pyo/.pyd files, so CPython bytecode can execute during import while remaining invisible to the scanner.

Preferred fix: upgrade to a release containing the PR fix(skill-scan): stop hiding compiled bytecode from audit surface. The fix includes compiled bytecode in both the LLM directory tree and static scan.

If you must patch v4.5.1 yourself:
1. Edit skill_scan/tools/dir/dir_actions.py.
2. Remove '__pycache__' from _IGNORED_DIRS.
3. Remove '.pyc', '.pyo', and '.pyd' from _IGNORED_EXTS.
4. Apply the same inclusion change to the static pre_scan file enumeration.
5. Restart the scanner and rescan.

Immediate workaround for an untrusted skill:

find skill -type d -name __pycache__ -print
find skill -type f \( -name '*.pyc' -o -name '*.pyo' -o -name '*.pyd' \) -print

find skill -type d -name __pycache__ -prune -exec rm -rf {} +
find skill -type f \( -name '*.pyc' -o -name '*.pyo' \) -delete

This is a bug in MCPTools.call_remote_tool (mcp_scan/utils/mcp_tools.py), which read only CallToolResult.content[0], discarding later content blocks, structuredContent, isError, and result/block metadata. Fixed by PR #727 (merged as commit 7b62e47110): update AI-Infra-Guard to a version including that commit. After the fix, call_remote_tool serializes the full CallToolResult — all content blocks, structured content, error status, and metadata — so structured-only responses and multi-block results reach the scan agent. The plain-text fast path for simple single-block results is preserved, and readable text is prioritized over opaque media within the 20,000-character history preview so later evidence is not hidden.

This occurs because prompt evaluation does not apply rate-limit-aware backoff when the target model returns QPM/429 errors. Failed calls can trigger rapid retries or additional dispatches, exceeding the configured concurrency and quota. Task shutdown also does not immediately terminate the whole worker process group, so in-flight or queued requests continue briefly.

Fix: upgrade to the release containing PR fix(prompt-eval): rate-limit aware backoff, circuit breaker and process-group termination (fixes #633), then restart the evaluation service/workers. The fix adds QPM/429 backoff, opens a circuit breaker when the model is rate-limited, and terminates the process group when the task is stopped.

Temporary workaround: enforce a client-side rate limit below the model's QPM quota, disable immediate retries or use exponential backoff for QPM errors, and manually stop/restart the worker process after cancelling a task to flush remaining requests.