T09 · Insecure Skill Coding Practices
Error
- Location
cli.py:406- Finding
Stored Financial Profile Transmitted in External Search Queries
- Content
View full analysis
str: """ Return a compact natural-language summary of the user profile suitable for injecting into a Brave Search query or LLM prompt. """ p = get_profile() parts = [] spend_fields = [ ("dining_monthly", "dining"), ("groceries_monthly", "groceries"), ("travel_monthly", "travel"), ("gas_monthly", "gas"), ("other_monthly", "other"), ] spend_parts = [f"${p[k]}/mo {label}" for k, label in spend_fields if p.get(k)] if spend_parts: parts.append("Spending: " + ", ".join(spend_parts)) if p.get("annual_fee_tolerance"): parts.append(f"Max annual fee: ${p['annual_fee_tolerance']}") if p.get("points_programs"): parts.append(f"Points programs: {p['points_programs']}") if p.get("home_airport"): parts.append(f"Home airport: {p['home_airport']}") if p.get("goal"): parts.append(f"Goal: {p['goal']}") if p.get("preferences"): parts.append(f"Preferences: {p['preferences']}") if cards: parts.append(f"Current cards: {', '.join(cards)}") return " | ".join(parts) if parts else "" ``` ```python # Enrich with saved profile context if available saved_ctx = _db.profile_as_context(cards=_db.get_card_names()) ctx = f"{saved_ctx} | " if saved_ctx else "" query = f"best credit cards {ctx}{profile} {pref}US 2025 site:nerdwallet.com OR site:thepointsguy.com OR site:doctorofcredit.com OR site:uscreditcardguide.com" _run_search(_get_wrapper(key), query, "recommend", as_json) ``` ### Technical Analysis The `recommend` command automatically reads the complete saved profile and wallet composition, serializes them into natural-language cont ...[truncated 1851 chars]- Remediation
View remediation