T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/audit.py:221
- Finding
- Detected Secrets Are Reproduced in JSON and Markdown Reports## Vulnerability Details **File Location**: `scripts/audit.py:221-230`, `scripts/audit.py:64-78`, `scripts/audit.py:589-603`, `scripts/audit.py:650` **Vulnerability Type**: Sensitive information exposure through audit output **Risk Level**: Medium ### Vulnerable Code ```python vulnerabilities.append(Vulnerability( id=f"SECRET-{name.upper().replace(' ', '-')}", name=f"Hardcoded {name}", severity=Severity.CRITICAL, file=str(filepath), line=line_num, description=f"Potential hardcoded {name.lower()} detected in code. This exposes credentials and should be moved to environment variables.", code_snippet=line.strip()[:200], remediation=f"Move the {name.lower()} to an environment variable and access it via os.environ.get() or use a secrets manager.", references=["https://owasp.org/www-community/vulnerabilities/Hardcoded_password"] )) ``` The captured line is subsequently included in serialized results: ```python def to_dict(self) -> dict: return { "skill_name": self.skill_name, "skill_path": self.skill_path, "passed": self.passed, "vulnerabilities": [ { "id": v.id, "name": v.name, "severity": v.severity.value, "file": v.file, "line": v.line, "description": v.description, "code_snippet": v.code_snippet, "remediation": v.remediation, "references": v.references } for v in self.vulnerabilities ], "summary": self.summary } ``` Markdown output also reproduces it: ```python lines.extend([ f"### {v.name}", "", f"- **ID:** {v.id}", f"- **Severity:** {v.severity.value.upper()}", f"- **File:** `{v.file}:{v.line}`", f"- **Description:** {v.description}", f"- **Code:** `{v.code_snip ...[truncated 2392 chars]
- Remediation
- ## Remediation Suggestions 1. Never store the complete matching line for secret findings. 2. Redact the matched span immediately during detection rather than relying only on output-time filtering. 3. Replace captured values with a fixed marker such as `[REDACTED]`, optionally retaining only a short non-sensitive suffix for identification. 4. Apply centralized defense-in-depth redaction before producing JSON, Markdown, or summary output. 5. Avoid including private-key bodies, connection-string passwords, authorization headers, or environment-variable values in any report field. 6. Add regression tests containing synthetic secrets and assert that none of those values appear in serialized reports or stdout. 7. Document that existing reports and CI logs generated by affected versions should be treated as potentially sensitive. 8. Rotate any real credentials that have already appeared in retained reports. Example masking approach: ```python matched_line = lines[line_num - 1] if line_num <= len(lines) else "" start = match.start() - content.rfind("\n", 0, match.start()) - 1 end = start + len(match.group(0)) redacted_line = matched_line[:start] + "[REDACTED]" + matched_line[end:] vulnerabilities.append(Vulnerability( # Other fields omitted code_snippet=redacted_line[:200], )) ```