In scanSkill:
if (statSync(f).size > MAX_BYTES) continue;
The file is dropped and nothing records that it happened. It is not in the findings, not in the files count, and not in any report output. The user sees a clean scan.
For a security scanner this is the worst possible failure mode: padding a malicious script past 2 MB with a comment block is a two-line evasion, and the tool actively reassures the user afterwards.
The same applies to the catch { continue; } on the read: an unreadable file is indistinguishable from an absent one.
Suggested fix
Track skipped files with a reason and surface them. At minimum in the human report and the JSON output; arguably a skipped file should also stop the run from being reported as clean.
Acceptance
- Scanning a directory containing a 3 MB text file reports that the file was not scanned, and why
- The same for a file that cannot be read
--json output includes the skipped list- A scan with skipped files is not presented as an all-clear
In
scanSkill:The file is dropped and nothing records that it happened. It is not in the findings, not in the
filescount, and not in any report output. The user sees a clean scan.For a security scanner this is the worst possible failure mode: padding a malicious script past 2 MB with a comment block is a two-line evasion, and the tool actively reassures the user afterwards.
The same applies to the
catch { continue; }on the read: an unreadable file is indistinguishable from an absent one.Suggested fix
Track skipped files with a reason and surface them. At minimum in the human report and the JSON output; arguably a skipped file should also stop the run from being reported as clean.
Acceptance
--jsonoutput includes the skipped list