T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/run.py:33- Finding
Incomplete File Coverage and Narrow Secret Detection Can Produce False-Negative Security Reports
- Content
View full analysis
= limit: break if path.is_file(): if path.suffix.lower() in {".md",".txt",".json",".yaml",".yml",".py",".js",".ts",".csv",".tsv",".sh"}: results.append(path) return results ``` ```python PATTERNS = { "curl_pipe_bash": r"curl\s+[^|]+\|\s*(bash|sh)", "dangerous_rm": r"\brm\s+-rf\s+(/|\*|~|\.{1,2})", "base64_exec": r"base64\s+(-d|--decode).+\|\s*(bash|sh|python)", "secret_like": r"(api[_-]?key|token|secret|password)\s*[:=]\s*['\"]?[A-Za-z0-9_\-]{8,}", "private_url": r"https?://[^/\s]+/(admin|internal|private|secret)", } def pattern_report(spec: dict, path: Path, limit: int) -> str: targets = [path] if path.is_file() else list_text_files(path, limit=limit) findings = [] for target in targets: text = read_text(target) for name, pattern in PATTERNS.items(): for match in re.finditer(pattern, text, flags=re.IGNORECASE): snippet = match.group(0) if "secret_like" == name: snippet = re.sub(r"([A-Za-z0-9_\-]{4})[A-Za-z0-9_\-]+", r"\1***", snippet) findings.append((str(target), name, snippet[:160])) ``` ### Technical Analysis The Skill is presented as a pre-publication secret-exposure gate, but directory scanning only examines files whose suffix appears in a narrow allowlist. This excludes several common locations and formats for sensitive material, including: - `.env` and related environment files - Extensionless files such as `credentials` - Private keys stored in `.pem` or `.key` files - Certificate and keystore formats - ...[truncated 2443 chars]- Remediation
View remediation