T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/context_cleanup_audit.py:109- Finding
Unredacted Session and Reasoning Content Persisted in Audit Reports
- Content
View full analysis
Vulnerability Details
File Location:
scripts/context_cleanup_audit.py, lines 109–149 and 202–215
Vulnerability Type: Sensitive information exposure through unredacted report generation
Risk Level: MediumVulnerable Code
python with session_path.open("r", encoding="utf-8") as f: for line in f: total_lines += 1 line = line.strip("\n") if not line: continue try: obj = json.loads(line) except Exception: continue if obj.get("type") != "message": continue msg = obj.get("message") or {} role = str(msg.get("role") or "") roles[role] += 1 tool_name = str(msg.get("toolName") or "") if tool_name: tool_names[tool_name] += 1 content = msg.get("content") or [] if not isinstance(content, list): continue for ci in content: if not isinstance(ci, dict): continue ctype = ci.get("type") if ctype == "text": text = ci.get("text") or "" if not isinstance(text, str) or not text: continue if "System:" in text: system_like += 1 if "Cron:" in text: cron_like += 1 consider(len(text), "text", str(obj.get("id") or ""), role, tool_name, _preview(text)) elif ctype == "thinking": think = ci.get("thinking") or "" if not isinstance(think, str) or not think: continue consider(len(think), "thinking", str(obj.get("id") or ""), role, tool_name, _preview(think))python if args.out: out_path = Path(args.out).expanduser().resolve() out_path.parent.mkdir(parents=True, exist_ok=True) out_path.write_text(json.dumps(report, indent=2, ensure_ascii=False), encoding="utf-8")Technical Analysis
The ...[truncated 2561 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove content previews from default reports. Record only metadata such as character count, role, message identifier, tool name, and content type.
- Place preview generation behind an explicit opt-in option such as
--include-previews, accompanied by a clear warning that reports may contain private data. - Apply robust redaction before serialization, covering API keys, bearer tokens, passwords, private keys, session cookies, authorization headers, personal data, and other configurable patterns.
- Exclude
thinkingcontent by default and require separate, explicit authorization before processing or exporting it. - Require explicit session selection instead of silently choosing the latest transcript, or display the selected path and request confirmation before reading it.
- Create output files with owner-only permissions, such as mode
0600, and verify permissions after creation. - Warn users to inspect and sanitize reports before sharing, uploading, or committing them.
- Add automated tests confirming that representative secrets never appear in default report output.
- Consider replacing previews with irreversible hashes or stable identifiers when correlation between repeated entries is required.