T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/tracer.py:52- Finding
Unredacted Operation Metadata and Results Persisted in Plaintext
- Content
View full analysis
str: """开始追踪一个操作 Args: name: 操作名称 op_type: 操作类型（tool_call / llm_call / error / compression） metadata: 附加元数据 Returns: span_id: 追踪跨度ID """ span_id = str(uuid.uuid4())[:8] span = Span( id=span_id, name=name, start_time=time.time(), metadata=metadata or {}, ) span.metadata["operation_type"] = op_type self._active_spans[span_id] = span return span_id ``` ```python def end_span(self, span_id: str, result: Any = None, status: str = "success"): """结束追踪 Args: span_id: 追踪跨度ID result: 操作结果 status: 状态（success / error） """ if span_id not in self._active_spans: return span = self._active_spans[span_id] span.end_time = time.time() span.duration_ms = (span.end_time - span.start_time) * 1000 span.result = str(result) if result is not None else None span.status = status # 持久化到 SQLite self._save_span(span) # 从活跃列表移除 self._active_spans.pop(span_id, None) ``` ```python def _save_span(self, span: Span): """保存 span 到数据库""" conn = sqlite3.connect(self.db_path) conn.execute( """INSERT OR REPLACE INTO traces (id, timestamp, operation_type, operation_name, duration_ms, metadata, result, status) VALUES (?, ?, ?, ?, ?, ?, ?, ?)""", ( span.id, span.start_time, span.metadata.get("operation_type", "unknown"), span.name, span.duration_ms, json.dumps(span.metadata, ensure_ascii=False), span.result, span.status, ...[truncated 2266 chars]- Remediation
View remediation