T09 · Insecure Skill Coding Practices
Error
- Location
main.py:458- Finding
Sensitive Context Values May Be Exposed in Application Logs
- Content
View full analysis
= 16 else m.group(0), content) # 掩码敏感关键词对应的值 for keyword in SENSITIVE_KEYWORDS: # 匹配 key: value 格式 pattern = re.compile(rf"({keyword}[\"']?\s*[=:]\s*[\"']?)([A-Za-z0-9_\-./+]+)([\"']?)", re.IGNORECASE) content = pattern.sub(lambda m: f"{m.group(1)}{m.group(2)[:4]}****{m.group(2)[-4:]}{m.group(3)}", content) ``` ### Technical Analysis The program logs the complete command arguments and context after applying `filter_sensitive_data()` independently to each context value. Because the key and value are separated before filtering, key-aware patterns such as `api_key=value`, `password=value`, or `token=value` cannot identify a sensitive value based on its original context key. The remaining standalone patterns only cover limited token formats. They do not reliably redact webhook URLs, session identifiers, cookies, short tokens, bearer credentials, email addresses, or API keys that do not match the expected length and character set. Sanitized command arguments are also logged in full and may contain private travel plans or other personal data. ### Attack Path 1. A user or platform places a sensitive value in a context field, such as a webhook URL, session token, or nonstandard API key. 2. The user invokes any Skill command. 3. `main()` converts the value ...[truncated 793 chars]- Remediation
View remediation