T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/universal_doc_generator.py:68- Finding
Sensitive Configuration Data Is Duplicated into Plaintext Documentation
- Content
View full analysis
Dict[str, Any]: """Extract configuration from JSON files.""" with open(self.source_file, 'r') as f: return json.load(f) def _yaml_config_extract(self) -> Dict[str, Any]: """Extract configuration from YAML files.""" with open(self.source_file, 'r') as f: return yaml.safe_load(f) ``` It then serializes the complete configuration into Markdown, YAML, and JSON output files: ```python # Markdown documentation output_subdir = os.path.join(self.output_dir, os.path.basename(self.source_file).replace('.py', '')) os.makedirs(output_subdir, exist_ok=True) with open(os.path.join(output_subdir, 'system_reference.md'), 'w') as md_file: md_file.write(f'# System Reference: {os.path.basename(self.source_file)}\n\n') md_file.write(f'**Generated:** {datetime.now().isoformat()}\n\n') md_file.write('## Configuration\n') md_file.write('```yaml\n') md_file.write(yaml.dump(config, default_flow_style=False)) md_file.write('```\n') # YAML Schema with open(os.path.join(self.output_dir, 'system_schema.yaml'), 'w') as yaml_file: yaml.dump({ 'source': self.source_file, 'generated_at': datetime.now().isoformat(), 'config': config }, yaml_file) # JSON Details with open(os.path.join(self.output_dir, 'system_details.json'), 'w') as json_file: json.dump({ 'source': self.source_file, 'generated_at': datetime.now().isoformat(), 'config': config }, json_file, indent=2) ``` The documentation schema explicitly identifies credentials as documenta ...[truncated 2443 chars]- Remediation
View remediation