T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/optimize.js:43- Finding
Overbroad workspace cleanup can move or delete legitimate files
- Content
View full analysis
{ const ext = path.extname(f).toLowerCase(); return junkExts.includes(ext) && fs.statSync(path.join(wsDir, f)).isFile(); }); if (junkFiles.length) { const junkSize = junkFiles.reduce((sum, f) => sum + fs.statSync(path.join(wsDir, f)).size, 0); issues.push({ type: 'junk', severity: 'high', msg: `${junkFiles.length} non-essential files in workspace root (${formatBytes(junkSize)})`, detail: junkFiles.map(f => ` ${f} (${formatBytes(fs.statSync(path.join(wsDir, f)).size)})`), fix: 'Move to scripts/ subdirectory or delete', savings: estimateTokens(junkFiles.map(f => readSafe(path.join(wsDir, f)) || '').join('')), }); if (apply) { const scriptsDir = path.join(wsDir, 'scripts'); if (!fs.existsSync(scriptsDir)) fs.mkdirSync(scriptsDir, { recursive: true }); for (const f of junkFiles) { const src = path.join(wsDir, f); const dst = path.join(scriptsDir, f); fs.renameSync(src, dst); } console.log(` ✅ Moved ${junkFiles.length} files to scripts/`); } } // 2. BOOTSTRAP.md still exists? const bootstrap = path.join(wsDir, 'BOOTSTRAP.md'); if (fs.existsSync(bootstrap)) { const size = fs.statSync(bootstrap).size; issues.push({ type: 'bootstrap', severity: 'high', msg: `BOOTSTRAP.md still exists (${formatBytes(size)}) — injected every session after setup is done`, fix: 'Delete it (bootstrap is complete)', savings: estimateTokens(readSafe(bootstrap) || ''), }); if (apply) { fs.unlinkSync(bootstrap); console.log(' ✅ Deleted BOOTSTRAP.md'); } } ``` ### Technical Analysis The `--ap ...[truncated 2016 chars]- Remediation
View remediation
` and `--delete-bootstrap` so destructive operations require specific authorization. ]]>