T09 · Insecure Skill Coding Practices
Error
- Location
scripts/convert.py:25- Finding
Incomplete Secret Redaction Can Expose Sensitive Memory Data
- Content
View full analysis
tuple[str, list[str]]: """Strip secret patterns from text. Returns (cleaned_text, warnings).""" warnings = [] for pat in SECRET_PATTERNS: matches = pat.findall(text) if matches: warnings.append(f"Stripped {len(matches)} potential secret(s) matching {pat.pattern[:40]}...") text = pat.sub("[REDACTED]", text) return text, warnings ``` ```python # --- Collect all warnings --- for ep_dir in ["mind", "facts", "summaries", "operational", "relationships"]: dir_path = output / ep_dir if not dir_path.exists(): continue for f in dir_path.glob("*.md"): content = f.read_text(errors="replace") _, file_warnings = strip_secrets(content) all_warnings.extend(file_warnings) ``` The documentation subsequently advises users to publish the generated data: ```markdown **Secrets are automatically stripped** (sk-*, ghp_*, tokens, passwords). Warnings emitted for any found. ## Post-Conversion Steps 1. `cd ~/expertpacks/my-agent-pack` 2. Verify content files are 400–800 tokens each (Schema 2.5 — retrieval-ready by design) 3. Measure EK ratio: `python3 /path/to/expertpack/tools/eval-ek.py .` 4. Review `overview.md` and `manifest.yaml` 5. Commit to git and publish to ClawHub ``` ### Technical Analysis The converter processes sensitive long-term agent data from `SESSION-STATE.md`, `MEMORY.md`, daily journals, topic files, Git-Notes JSONL records, an ...[truncated 2524 chars]- Remediation
View remediation