Summary
SkillProvenanceGuard's download-count anomaly heuristics produce guaranteed false positives with trivial attacker evasion:
MIN_DOWNLOAD_COUNT = 10 (provenance.py:98,281-286): any skill with fewer than 10 downloads is BLOCKED — i.e., every legitimately published new skill is blocked on publication day.SUSPICIOUSLY_ROUND = 1000 (:99,287-291): any count exactly divisible by 1000 is BLOCKED — a legitimate skill at exactly 1000/2000/... downloads gets blocked at random moments of its life.- An attacker choosing a count simply picks 11, or 1001 — both checks evade trivially.
CONFIRMED BY EXECUTION (2026-08-23 audit @ 518192b): a fully clean manifest (github.com source, valid digest format) returns verified=False with "Suspiciously low download count (5)" at count 5, and "suspiciously round" at count 1000; count 150 passes.
Why this is worse than a normal FP
These are blocking decisions, not warnings — a legitimate skill fails the whole guard, while the attack class the heuristic targets (bot-inflated marketplace counts) is controlled by the very attacker who can also pick the count. Net effect: costs for honest publishers, zero cost for attackers. Same guard already has the registry-matching inversion (#18) and digest format-only (#30) — the download signal is the third heuristic that asserts more than it can know.
Remediation
Download counts are metadata supplied by the same registry being audited — they cannot be a blocking security signal. Either drop both checks, or downgrade to advisory findings that appear in findings without flipping verified to False.
Summary
SkillProvenanceGuard's download-count anomaly heuristics produce guaranteed false positives with trivial attacker evasion:MIN_DOWNLOAD_COUNT = 10(provenance.py:98,281-286): any skill with fewer than 10 downloads is BLOCKED — i.e., every legitimately published new skill is blocked on publication day.SUSPICIOUSLY_ROUND = 1000(:99,287-291): any count exactly divisible by 1000 is BLOCKED — a legitimate skill at exactly 1000/2000/... downloads gets blocked at random moments of its life.CONFIRMED BY EXECUTION (2026-08-23 audit @
518192b): a fully clean manifest (github.com source, valid digest format) returnsverified=Falsewith "Suspiciously low download count (5)" at count 5, and "suspiciously round" at count 1000; count 150 passes.Why this is worse than a normal FP
These are blocking decisions, not warnings — a legitimate skill fails the whole guard, while the attack class the heuristic targets (bot-inflated marketplace counts) is controlled by the very attacker who can also pick the count. Net effect: costs for honest publishers, zero cost for attackers. Same guard already has the registry-matching inversion (#18) and digest format-only (#30) — the download signal is the third heuristic that asserts more than it can know.
Remediation
Download counts are metadata supplied by the same registry being audited — they cannot be a blocking security signal. Either drop both checks, or downgrade to advisory findings that appear in
findingswithout flippingverifiedto False.