T09 · Insecure Skill Coding Practices
Error
- Location
scripts/evaluate.py:185- Finding
Unrestricted Local File Content Can Be Forwarded to an External LLM
- Content
View full analysis
str: """Extract the SKILL.md content for a candidate. Candidates may have their own 'skill_content' or 'content' field. If not, read the original SKILL.md from the target path. """ # Check candidate for inline content for key in ("skill_content", "content", "body"): if key in candidate and candidate[key]: return candidate[key] # Fallback: read original SKILL.md from target target_path = Path(target.get("path", "")) skill_md = target_path / "SKILL.md" if target_path.is_dir() else target_path if skill_md.exists(): return skill_md.read_text(encoding="utf-8") raise ValueError(f"Cannot find SKILL.md content for candidate or at {target_path}") def get_baseline_skill_content(target: dict) -> str: """Read the original (baseline) SKILL.md from the target path.""" target_path = Path(target.get("path", "")) skill_md = target_path / "SKILL.md" if target_path.is_dir() else target_path if skill_md.exists(): return skill_md.read_text(encoding="utf-8") raise ValueError(f"Baseline SKILL.md not found at {target_path}") ``` The resulting content is passed into task execution: ```python candidate_skill = get_skill_content(candidate, target) logger.info("Running %d tasks for candidate '%s'...", len(tasks), args.candidate_id) candidate_results = run_task_suite(runner, candidate_skill, tasks, pass_k=args.pass_k) ``` ```python try: baseline_skill = get_baseline_skill_content(target) except ValueError: logger.warning("Baseline SKILL.md not found; using 0.0 as baseline") baseline_skill = None ``` `TaskRunner` then embeds t ...[truncated 3282 chars]- Remediation
View remediation