T09 · Insecure Skill Coding Practices
Warning
- Location
legacy-import.js:14- Finding
Long-term memory data can be transmitted to an unrestricted plaintext endpoint
- Content
View full analysis
{ const builder = sdk_1.DbConnection.builder() .withUri(URL) .withDatabaseName(DB_NAME) .onConnect(() => resolve()) .onConnectError((ctx, err) => reject(err)); db = builder.build(); }); for (const file of filesToImport) { const fullPath = path.join(workspace, file); if (fs.existsSync(fullPath)) { const content = fs.readFileSync(fullPath, 'utf8'); if (content.includes("migrated to SpacetimeDB")) { console.log(`Skipping ${file} - already migrated`); continue; } console.log(`Importing ${file}...`); const backupPath = `${fullPath}.bak`; fs.copyFileSync(fullPath, backupPath); const id = Date.now().toString() + Math.floor(Math.random() * 1000).toString(); const timestamp = BigInt(Date.now()) * 1000n; const tags = ['legacy', 'import', file.replace('.md', '').toLowerCase()]; try { db.reducers.storeMemory({ id, content: content.trim(), timestamp, tags }); ``` The ordinary storage tool uses the same unrestricted endpoint: ```js const content = args.c ...[truncated 2966 chars]- Remediation
View remediation