T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/render_document.py:88- Finding
Undeclared Table Cells Are Destructively Cleared Without Reliable Integrity Validation
- Content
View full analysis
--template ``` ### Technical Analysis The renderer treats every nonempty top-level table cell that is absent from both `placeholders` and `static_texts` as disposable example data. This is an unsafe fail-open design because the fill contract is generated by an LLM and can be incomplete. `validate_contract.py` validates placeholder locations but does not verify that every original nonempty table cell is classified as either static or replaceable. Therefore, an omitted cell can pass contract validation and subsequently be erased. The final format validator primarily compares document structu ...[truncated 1795 chars]- Remediation
View remediation
\ --template \ --contract ``` 6. Extend final validation to compare every non-placeholder cell against the original template, independently of the LLM-generated `static_texts` list. 7. Treat any nonempty `cleared_cells` result as an error unless every cleared location was explicitly authorized. 8. Add tests covering incomplete contracts, merged cells, nested tables, and preservation of undeclared nonempty content. ]]>