T09 · Insecure Skill Coding Practices
Error
- Location
scripts/llm-voter.ts:157- Finding
Cross-session conversation data is disclosed to the configured LLM provider
- Content
View full analysis
f.endsWith(".jsonl")) .map((f: string) => ({ name: f, mtime: statSync(join(sessDir, f)).mtimeMs })) .sort((a, b) => b.mtime - a.mtime); if (files.length === 0) return "(no session context available)"; const latest = join(sessDir, files[0].name); const raw = readFileSync(latest, "utf-8"); const lines = raw.split("\n").slice(-50).join("\n"); const userMessages: string[] = []; for (const line of lines.split("\n")) { if (!line.trim()) continue; try { const entry = JSON.parse(line); const msg = entry.message ?? entry; if (msg.role === "user") { const text = typeof msg.content === "string" ? msg.content : Array.isArray(msg.content) ? msg.content .filter((b: any) => b.type === "text") .map((b: any) => b.text) .join(" ") : ""; if (text.trim()) userMessages.push(text.trim().slice(0, 500)); } } catch { /* skip malformed lines */ } } return userMessages.slice(-3).join("\n---\n") || "(no user messages found)"; } catch { return "(failed to read session context)"; } } ``` ```ts function buildPrompt(toolName: string, params: Record, context: string): string { const detail = toolName === "exec" ? `Command: ${params.command ?? "(empty)"}` : `File path: ${params.file_path ?? params.path ?? "(empty)"}`; return ...[truncated 2771 chars]- Remediation
View remediation