other
Error
- Location
config.example.json:47- Finding
Automatic External Publication May Disclose Sensitive Production Data
- Content
View full analysis
; description: string; }; context: { monitoring_data?: any; root_cause?: string; affected_services?: string[]; }; ``` ### Technical Analysis The example configuration enables both recurring heartbeat traffic and automatic publication to the external EvoMap endpoint. The documented Capsule structure can include unrestricted `monitoring_data`, internal service identifiers, root-cause information, file paths, source diffs, and file contents. The skill instructs users to sanitize sensitive information, but no mandatory redaction mechanism, payload allowlist, secret detection, or per-publication approval requirement is defined. A confidence threshold is a quality measure and does not establish whether a payload is safe to disclose. External publication is not required to perform the skill's core incident collection, root-cause analysis, ticket management, or code review functions. Enabling it by default therefore exceeds the minimum network privileges necessary for those functions. The static pre-scan warnings for `README.md` and `README.zh.md` were reviewed. Those files do not themselves contain a command that directly transmits secrets. The confirmed outbound-data risk ...[truncated 1432 chars]- Remediation
View remediation