feat: AVE-2026-00075 -- bytecode poisoning (compiled cache/source divergence)

[chaksaray]

Summary

• Adds AVE-2026-00075: a skill ships a compiled .pyc bytecode file alongside its own .py source, and the compiled bytecode contains dangerous primitives (process execution, network calls, credential-path access) absent from the visible source text. CPython prefers a valid cached .pyc over recompiling its source whenever the header validates, so whatever the .pyc actually contains is what runs -- a reviewer or source-only scanner sees only the benign .py.
• Distinct from AVE-2026-00057 (obfuscated/encoded skill payload): 00057 is a single artifact whose own content is encoded, requiring a decode-then-rescan step to see the same payload the scanner already has. This is a two-artifact divergence -- the payload isn't present, encoded or otherwise, anywhere the scanner looks, because it's only in the compiled sibling.
• Verified via keyword sweep (matched AVE-2026-00057 on the word "bytecode"), field-level comparison confirming the mechanisms diverge (single-artifact content obfuscation vs. two-artifact compiled/source divergence via interpreter cache precedence), and by reading the actual repo-forensics scanner source, not just its README:
  • Primary source: alexgreensh/repo-forensics scan_bytecode.py -- unmarshals/disassembles .pyc files in an isolated subprocess and diffs a fixed danger-primitive marker list against the sibling source (_poison_markers_vs_source).
  • Independent real-world confirmation: CSA AI Safety Initiative research note, with research by Trail of Bits (2026-06-10) -- demonstrated env-var-exfiltration logic embedded in precompiled bytecode next to a benign-looking skill, bypassing scanners including NVIDIA SkillSpector.
• Severity MEDIUM, AIVSS 4.4 (cvss_base 7.5, aars 3.0, mitigation_factor 0.83 -- recompiling from source and refusing untrusted .pyc/__pycache__ content is a known, practical mitigation).
• mitre_atlas researched and left empty rather than force-fit: AML.T0010.001 (AI Software) and AML.T0010.003 (Model) are adjacent but neither names a compiled-bytecode-cache-diverging-from-its-own-source mechanism specifically.
• Builds on feat: AVE-2026-00074 -- reclaimable dead external anchor (SkillJacking) #135 (AVE-2026-00074, already merged).

Test plan

• python3 scripts/validate_records.py -- 75/75 records valid
• python3 scripts/check_fixtures.py -- all records have positive + negative fixtures
• pytest tests/ -x -q -- 301 passed
• node scripts/build-records.js -- dist regenerated, frozen v1.1.0 snapshot untouched
• README record count (badge, Stats table, collapsible index) and CHANGELOG updated