Tencent AI-Infra-Guard’s skill‑scan component intentionally skips analysis of compiled Python bytecode by hard‑coding exclusion rules for __pycache__ directories and .pyc/.pyo/.pyd extensions. Attackers can create a skill package that contains harmless Python source files and malicious compiled bytecode. During installation the operator imports the skill, causing the embedded bytecode to execute while the scanner reports a safe verdict, effectively bypassing the security check and enabling code execution on the target system.

Vendors affected are Tencent’s AI‑Infra‑Guard, specifically the skill‑scan component of version 4.6.0. This includes the package under the name a_i‑infra‑guard and its included scan utilities and directory actions as referenced in the project repository.

The CVSS score of 7.1 indicates a high‑medium severity vulnerability. EPSS data is not available and the flaw is not listed in the CISA KEV catalog. The most likely attack vector is a trusted operator manually installing a malicious skill package; an attacker can also distribute such a package in a supply chain. Successful exploitation yields local code execution with the privileges of the installation process.