T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/scan_hermes_continuation.py:154- Finding
Unredacted Hermes Conversation Data Exposed Through Scanner Output
- Content
View full analysis
list[dict[str, Any]]: path = Path(db_path) if not path.exists() or not sessions: return [] con = sqlite3.connect(path) try: out: list[dict[str, Any]] = [] for session in sorted(sessions): rows = con.execute( """ select id, session_id, length(content), finish_reason, content from messages where session_id=? and role='assistant' and finish_reason='stop' order by id desc limit ? """, (session, limit), ).fetchall() for mid, sid, size, finish_reason, content in rows: out.append( { "id": mid, "session": sid, "length": size, "finish_reason": finish_reason, "content": (content or "")[:700], } ) return out finally: con.close() ``` At lines 242-273, the scanner reads the complete log and associates raw user messages with output records: ```python for line in log.read_text(errors="ignore").splitlines(): match = TURN_RE.search(line) if match and is_recent(match.group("ts"), cutoff): ...[truncated 4641 chars]- Remediation
View remediation