T09 · Insecure Skill Coding Practices
Error
- Location
scripts/toggle.py:151- Finding
Unredacted Sensitive Activity Data Is Printed and Persisted in Plaintext
- Content
View full analysis
dict: url = f"{API_BASE}?fromDate={from_date}&toDate={to_date}" req = Request(url, headers={ "accept": "application/json", "x-openclaw-api-key": api_key, }) try: with urlopen(req) as resp: return json.loads(resp.read().decode()) ``` ```python def build_toggle_section(day_data: list) -> str: return ( f"{TOGGLE_START}\n" f"## Toggle Activity\n\n" f"```json\n{json.dumps(day_data, indent=2)}\n```\n" f"{TOGGLE_END}" ) def persist_day(memory_dir: str, day: str, workflows: list): path = os.path.join(memory_dir, f"{day}.md") section = build_toggle_section(workflows) if os.path.exists(path): with open(path, "r") as f: content = f.read() pattern = re.compile( rf"{re.escape(TOGGLE_START)}.*?{re.escape(TOGGLE_END)}", re.DOTALL, ) if pattern.search(content): content = pattern.sub(lambda _: section, content) else: content = content.rstrip() + "\n\n" + section + "\n" else: content = f"# {day}\n\n{section}\n" with open(path, "w") as f: f.write(content) ``` ```python data = fetch(api_key, args.from_date, args.to_date) print(json.dumps(data, indent=2)) if args.persist: memory_dir = args.persist os.makedirs(memory_dir, exist_ok=True) workflows_by_date = data.get("workflowsByDate", {}) if not workflows_by_date: print("No workflow data to persist.", file=sys.stderr) return for day, workflows in workflows_by_date.items(): persist_day(memory_dir, day, workflows) ``` Th ...[truncated 3312 chars]- Remediation
View remediation