T09 · Insecure Skill Coding Practices
Warning
- Location
global_cognitive_brain.py:59- Finding
Unredacted Persistent Storage of Conversation Content
- Content
View full analysis
20: working_memory['recent_dialogues'] = working_memory['recent_dialogues'][-20:] save_json(WORKING_FILE, working_memory) ``` ```python def layer2_working_memory(user_input: str, layer1_result: Dict) -> Dict: """L2: Working memory integration.""" # Add to working memory add_working_memory(user_input, 'user') ``` ```python def run(user_input: str) -> Dict: """Main entry point - execute five-layer thinking and return result.""" # Execute thinking thought_trace = five_layer_thinking(user_input) # Select skill selected_skill = select_skill(user_input) # Build response final_response = build_response(user_input, thought_trace, selected_skill) # Auto-save all memory after each run save_json(WORKING_FILE, working_memory) save_json(EPISODIC_FILE, episodic_memory) save_json(SEMANTIC_FILE, semantic_memory) save_json(META_FILE, meta_memory) ``` ### Technical Analysis Every input processed by the thinking pipeline is written to a plaintext JSON file. The implementation does not: - Request consent before enabling persistence. - Identify or redact passwords, API tokens, private keys, personal information, or proprietary data. - Encrypt persisted content. - enforce restrictive file permissions. - Provide a user-facing deletion or retention mechanism. - Isolate memory by ...[truncated 1391 chars]- Remediation
View remediation