fix: fail closed on oversized Skops entries

[mldangelo-oai]

Summary

Fail closed when Skops content analysis has to skip oversized ZIP members because they exceed the bounded read limit.

Security impact

Previously, _read_zip_entry_safely() returned None for oversized members and each CVE detector quietly continued. That meant a large malicious README, card, or payload file could evade content-based checks while the overall scan still finished successfully. This change records a single explicit oversized-entry warning, marks the scan outcome inconclusive, and preserves the bounded-read limit.

Validation

• uv run ruff format modelaudit/scanners/skops_scanner.py tests/scanners/test_skops_scanner.py
• PROMPTFOO_DISABLE_TELEMETRY=1 uv run pytest tests/scanners/test_skops_scanner.py -q
• uv run mypy modelaudit/scanners/skops_scanner.py tests/scanners/test_skops_scanner.py

[github-actions]

Workflow run and artifacts

Performance Benchmarks

Compared 19 shared benchmarks with a regression threshold of 15%.
Status: 0 regressions, 0 improved, 19 stable, 0 new, 0 missing.
Aggregate shared-benchmark median: 193.87ms -> 182.82ms (-5.7%).

Benchmark	Target	Size	Files	Baseline	Current	Change	Status
tests/benchmarks/test_scan_benchmarks.py::test_scan_pytorch_zip	state_dict.pt	1.5 MiB	1	33.80ms	29.91ms	-11.5%	stable
tests/benchmarks/test_scan_benchmarks.py::test_scan_mixed_directory	mixed-corpus	1.7 MiB	54	76.71ms	70.81ms	-7.7%	stable
tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_dangerous_global_payloads[stack_global]	stack_global	21 B	1	67.5us	65.3us	-3.2%	stable
tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payloads[nested_base64]	nested_base64	98 B	1	106.1us	102.8us	-3.1%	stable
tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payloads[nested_hex]	nested_hex	130 B	1	110.5us	107.0us	-3.1%	stable
tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_safe_payloads[safe_large]	safe_large	278.2 KiB	1	3.53ms	3.43ms	-2.8%	stable
tests/benchmarks/test_scan_benchmarks.py::test_detect_file_format_safe_pickle	safe_model.pkl	49.4 KiB	1	30.5us	31.2us	+2.1%	stable
tests/benchmarks/test_scan_benchmarks.py::test_validate_file_type_pytorch_zip	state_dict.pt	1.5 MiB	1	52.2us	53.3us	+2.1%	stable
tests/benchmarks/test_scan_benchmarks.py::test_scan_duplicate_directory	duplicate-corpus	840.0 KiB	81	46.81ms	45.89ms	-2.0%	stable
tests/benchmarks/test_scan_benchmarks.py::test_skip_filter_plain_text_files	-	4.6 KiB	256	13.55ms	13.33ms	-1.7%	stable
tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_multi_stream_padded_payload	multi_stream_padded	4.1 KiB	1	133.5us	135.5us	+1.5%	stable
tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_chunked_stream	chunked_stream	278.2 KiB	1	6.59ms	6.51ms	-1.4%	stable
tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_opcode_budget_tail_payload	opcode_budget_tail	14 B	1	75.1us	75.7us	+0.9%	stable
tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_safe_payloads[safe_small]	safe_small	68 B	1	56.2us	56.6us	+0.8%	stable
tests/benchmarks/test_scan_benchmarks.py::test_scan_safe_pickle	safe_model.pkl	49.4 KiB	1	10.39ms	10.47ms	+0.8%	stable
tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_safe_payloads[long_benign_string]	long_benign_string	1.0 MiB	1	1.10ms	1.10ms	-0.5%	stable
tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_dangerous_global_payloads[malicious_reduce]	malicious_reduce	52 B	1	77.6us	77.7us	+0.2%	stable
tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_nested_payloads[nested_raw]	nested_raw	78 B	1	99.7us	99.5us	-0.1%	stable
tests/benchmarks/test_picklescan_benchmarks.py::test_picklescan_hidden_suspicious_string_budget	hidden_suspicious_string	8.0 KiB	1	574.9us	574.5us	-0.1%	stable

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a3691091ab

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Classify oversized-entry failure as informational

Set Skops Oversized ZIP Entry to WARNING causes inconclusive scans to be treated as real security findings. core_results.results_have_security_findings() counts WARNING issues, so results_should_be_unsuccessful() no longer treats these as inconclusive-only and determine_exit_code() returns 1 instead of 2. This mislabels bounded-read incompleteness as a confirmed vuln in automation.

Useful? React with 👍 / 👎.