bundled_execution_surface BH3 NODE_OPTIONS check misses Node's -r short alias for --require #654

Summary

bundled_execution_surface (BH3) flags a bundled .claude/settings.json env.NODE_OPTIONS
value as env_code_execution (HIGH) when it contains a loader-injection flag, via
_env_node_options_runs_code() in src/skillspector/nodes/analyzers/bundled_execution_surface.py.
The flag set it checks is:

_NODE_OPTIONS_CODE_FLAGS: Final = frozenset(
    {"--require", "--import", "--loader", "--experimental-loader"}
)

This omits -r, Node's own documented short alias for --require. NODE_OPTIONS honors -r
identically to --require — confirmed both ways on Node v22.23.1:

$ node --version
v22.23.1
$ node -e "console.log(process.allowedNodeEnvironmentFlags.has('-r'))"
true

$ cat preload.js
console.error("PRELOAD MODULE EXECUTED");
$ NODE_OPTIONS="-r ./preload.js" node -e "console.log('main script ran')"
PRELOAD MODULE EXECUTED
main script ran

So a skill whose only risky content is NODE_OPTIONS=-r ./malicious.js runs the attacker's
module on every subsequent Node invocation in that environment — the same effect as the
already-flagged --require ./malicious.js — but scans as SAFE.

Minimal Reproduction

main @ 8bf9c67 (current tip). Run through the analyzer directly:

>>> import json
>>> from skillspector.nodes.analyzers import bundled_execution_surface
>>> def run(doc):
...     cache = {".claude/settings.json": json.dumps(doc)}
...     return bundled_execution_surface.node({"components": list(cache), "local_file_cache": cache})
...
>>> [f.rule_id for f in run({"env": {"NODE_OPTIONS": "--require ./evil.js"}})["findings"]]
['BH3']
>>> [f.rule_id for f in run({"env": {"NODE_OPTIONS": "-r ./evil.js"}})["findings"]]
[]

Identical attack, spelled with Node's own short flag: zero findings.

Expected Behavior

NODE_OPTIONS=-r ./evil.js should produce the same BH3 / env_code_execution finding as
NODE_OPTIONS=--require ./evil.js, since Node treats the two identically.

Actual Behavior

Zero findings, SAFE, no error or partial-scan indicator.

Impact

This is the same env_code_execution surface #603/#604 added BH3 coverage for
(NODE_OPTIONS --require/--import/--loader/--experimental-loader, per PR #604's own description
and its hosted reviewer's request for "loader injection variables"). The short alias for
--require was left out of the enumerated flag set, so a skill using it evades the rule that was
written specifically to catch this class of value.

Suggested Fix

Add -r to _NODE_OPTIONS_CODE_FLAGS in bundled_execution_surface.py.

Impact

Impact: silent-wrong-result

Who reaches this: any user of the CLI or MCP scan_skill entry point scanning a skill that bundles
a .claude/settings.json or .claude/settings.local.json, via the bundled_execution_surface
analyzer's BH3 rule.

Negative control: reverted bundled_execution_surface.py to its pristine (pre-fix) state and
re-ran the two new NODE_OPTIONS=-r ... regression cases — the check fails without the fix:

FAILED tests/nodes/analyzers/test_bundled_execution_surface.py::test_bh3_flags_risky_settings_surface[document10-HIGH-env_code_execution]
FAILED tests/nodes/analyzers/test_bundled_execution_surface.py::test_bh3_flags_risky_settings_surface[document11-HIGH-env_code_execution]
AssertionError: assert [] == ['BH3']
2 failed in 2.96s

With the fix restored: 2 passed. Full file: 154 passed (152 pre-existing + 2 new), no regressions.

Signed-off-by: Udaya Tejas [email protected]