celvexgroup/modelaudit-skops-scanner-evasion-poc

PoC - modelaudit skops scanner evasion (ConstructorFromReduceNode untrusted-type gap)

Coordinated disclosure PoC for huntr (Protect AI MFV). Benign payload only.

• Scanner under test: modelaudit==0.2.49 (skops_scanner.py), skops==0.14.0, scikit-learn 1.9.0, Python 3.11.15.
• Format: .skops (zip-based; the sklearn / joblib-ecosystem secure-serialization format).
• Two-sided behavior: modelaudit scan evil.skops -> Clean / exit 0 (Scanner: skops, NO ISSUES FOUND), but loading via the documented skops trusted= workflow executes posix.system(<benign marker>). skops itself is correct: skops.io.get_untrusted_types(file='evil.skops') returns ['posix.system'] and the default loader refuses it; modelaudit never enumerates that untrusted-type set.
• Benign marker: the reduce node calls posix.system to touch a harmless sentinel file. No destructive action.
• Root cause: modelaudit's skops scanner is a narrow 3-signature matcher (hardcodes CVE-2025-54412 / 54413 / 54886 plus a few joblib/pickle byte patterns) rather than a trust-boundary model. A generic ConstructorFromReduceNode for posix.system matches none of those signatures, so the file scans Clean.

Files: evil.skops (reduce node at document root), stealth.skops (same gadget grafted onto a real fitted LogisticRegression that still predicts), build_evil_skops.py (builder). Full report + positive controls in the huntr submission.