T09 · Insecure Skill Coding Practices
Error
- Location
scripts/anonymize.ts:13- Finding
Incomplete anonymization can expose secrets and personal information in public uploads
- Content
View full analysis
= [ // Credentials { regex: /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g, replacement: '[EMAIL]' }, { regex: /sk-[a-zA-Z0-9-]{20,}/g, replacement: '[API_KEY]' }, { regex: /opensoul_sk_[a-zA-Z0-9]+/g, replacement: '[API_KEY]' }, { regex: /api[_-]?key['":\s]+['"]?[a-zA-Z0-9-]{16,}['"]?/gi, replacement: '[API_KEY]' }, { regex: /password['":\s]+['"]?[^\s'"]{4,}['"]?/gi, replacement: '[PASSWORD]' }, // Paths { regex: /\/Users\/[a-zA-Z0-9_-]+\//g, replacement: '/Users/[USER]/' }, { regex: /\/home\/[a-zA-Z0-9_-]+\//g, replacement: '/home/[USER]/' }, { regex: /C:\\Users\\[a-zA-Z0-9_-]+\\/g, replacement: 'C:\\Users\\[USER]\\' }, // IPs & phones { regex: /\b192\.168\.\d{1,3}\.\d{1,3}\b/g, replacement: '[LOCAL_IP]' }, { regex: /\b10\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/g, replacement: '[LOCAL_IP]' }, { regex: /\+\d[\d\s\-()]{9,}/g, replacement: '[PHONE]' }, ]; ``` `scripts/summarize.ts:155-170`: ```typescript cronJobs: (data.cronJobs || []).filter((j: any) => j.enabled).map((j: any) => ({ name: j.name, schedule: j.schedule, description: j.description, })), integrations: summary.toolsUsed, persona: { tone: [], style: [], boundaries: [] }, }, raw: { soul: data.soul, agents: data.agents, identity: data.identity, tools: data.toolsRaw, memoryHighlights: null, }, ``` `scripts/upload.ts:84-91`: ```typescript // Files files: { soul_md: data.raw?.soul || null, agents_md: data.raw?.agents || null, tools_md: data.raw?.tools || null, // Anonym ...[truncated 2554 chars]- Remediation
View remediation