T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/src/core/storage.ts:62- Finding
Unrestricted Filesystem Access Through Exported Storage Functions
- Content
View full analysis
( data: T, category: string, operation: string, name?: string ): string { const settings = getSettings(); const categoryDir = join(settings.resultsDir, category); // Ensure category directory exists if (!existsSync(categoryDir)) { mkdirSync(categoryDir, { recursive: true }); } // Build filename - use name if provided, otherwise operation with timestamp let filename: string; if (name) { const sanitizedName = sanitizeFilename(name).substring(0, 50); filename = `${sanitizedName}.json`; } else { const timestamp = getTimestamp(); const sanitizedOperation = sanitizeFilename(operation); filename = `${timestamp}__${sanitizedOperation}.json`; } const filepath = join(categoryDir, filename); // Build wrapped result const result: SavedResult = { metadata: { savedAt: new Date().toISOString(), category, operation, ...(name && { name }), }, data, }; // Write to file writeFileSync(filepath, JSON.stringify(result, null, 2), 'utf-8'); return filepath; } ``` ```typescript export function loadResult(filepath: string): SavedResult | null { if (!existsSync(filepath)) { return null; } try { const content = readFileSync(filepath, 'utf-8'); return JSON.parse(content) as SavedResult; } catch { return null; } } ``` ```typescript export function listResults(category: string, limit?: number): string[] { const settings = getSettings(); const categoryDir = join(settings.resultsDir, category); if (!existsSync(categoryDir)) { return []; } co ...[truncated 3766 chars]- Remediation
View remediation