T09 · Insecure Skill Coding Practices
Error
- Location
scripts/distill.py:33- Finding
Secret Sanitization Is Not Applied During Distillation and Does Not Cover All Scanned Sources
- Content
View full analysis
'), (re.compile(r'(sk-)[a-zA-Z0-9]{20,}'), r'\1'), (re.compile(r'(ghp_)[a-zA-Z0-9]{36,}'), r'\1'), (re.compile(r'(xoxb-)[a-zA-Z0-9\-]+'), r'\1'), ] def strip_secrets(text: str) -> str: """Replace known secret patterns with .""" for pattern, replacement in SECRET_PATTERNS: text = pattern.sub(replacement, text) return text ``` However, the function is never invoked. The script only creates scaffolding and delegates content processing to the calling agent: ```python # List source files for this pack from the scan source_files = [f for f in scan.get("files", []) if f.get("pack") == pack_slug] print(f"Source files to distill: {len(source_files)}") for sf in source_files: flag = " ⚠️ SECRETS" if sf.get("has_secret_patterns") else "" flag += " 🔍 NEEDS ANALYSIS" if sf.get("needs_content_analysis") else "" print(f" [{sf['confidence']:.1f}] {sf['path']} → {sf['section']}{flag}") print(f"\nNext: Agent reads source files and writes distilled content to {output_dir}/") ``` Secret checks are applied to a limited subset of files: ```python for fname, meta in AGENT_FILES.items(): fpath = ws / fname if fpath.exists(): entry = _make_file_entry(fpath, ws, agent_slug, meta["section"], meta["confidence"]) _check_secrets(fpath, entry, manifest) manifest["files"].append(entry) packs[agent_slug]["sources" ...[truncated 5483 chars]- Remediation
View remediation