T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/audit.py:221- Finding
Detected Secrets Are Reproduced in JSON and Markdown Reports
- Content
View full analysis
Vulnerability Details
File Location:
scripts/audit.py:221-230,scripts/audit.py:64-78,scripts/audit.py:589-603,scripts/audit.py:650
Vulnerability Type: Sensitive information exposure through audit output
Risk Level: MediumVulnerable Code
python vulnerabilities.append(Vulnerability( id=f"SECRET-{name.upper().replace(' ', '-')}", name=f"Hardcoded {name}", severity=Severity.CRITICAL, file=str(filepath), line=line_num, description=f"Potential hardcoded {name.lower()} detected in code. This exposes credentials and should be moved to environment variables.", code_snippet=line.strip()[:200], remediation=f"Move the {name.lower()} to an environment variable and access it via os.environ.get() or use a secrets manager.", references=["https://owasp.org/www-community/vulnerabilities/Hardcoded_password"] ))The captured line is subsequently included in serialized results:
python def to_dict(self) -> dict: return { "skill_name": self.skill_name, "skill_path": self.skill_path, "passed": self.passed, "vulnerabilities": [ { "id": v.id, "name": v.name, "severity": v.severity.value, "file": v.file, "line": v.line, "description": v.description, "code_snippet": v.code_snippet, "remediation": v.remediation, "references": v.references } for v in self.vulnerabilities ], "summary": self.summary }Markdown output also reproduces it:
python lines.extend([ f"### {v.name}", "", f"- **ID:** {v.id}", f"- **Severity:** {v.severity.value.upper()}", f"- **File:** `{v.file}:{v.line}`", f"- **Description:** {v.description}", f"- **Code:** `{v.code_snip ...[truncated 2392 chars]- Remediation
View remediation
Remediation Suggestions
- Never store the complete matching line for secret findings.
- Redact the matched span immediately during detection rather than relying only on output-time filtering.
- Replace captured values with a fixed marker such as
[REDACTED], optionally retaining only a short non-sensitive suffix for identification. - Apply centralized defense-in-depth redaction before producing JSON, Markdown, or summary output.
- Avoid including private-key bodies, connection-string passwords, authorization headers, or environment-variable values in any report field.
- Add regression tests containing synthetic secrets and assert that none of those values appear in serialized reports or stdout.
- Document that existing reports and CI logs generated by affected versions should be treated as potentially sensitive.
- Rotate any real credentials that have already appeared in retained reports.
Example masking approach:
python matched_line = lines[line_num - 1] if line_num <= len(lines) else "" start = match.start() - content.rfind("\n", 0, match.start()) - 1 end = start + len(match.group(0)) redacted_line = matched_line[:start] + "[REDACTED]" + matched_line[end:] vulnerabilities.append(Vulnerability( # Other fields omitted code_snippet=redacted_line[:200], ))