T09 · Insecure Skill Coding Practices
- Location
scripts/generate_report.py:713- Finding
Sensitive information is persisted in generated reports before warning-only detection
- Content
View full analysis
Vulnerability Details
File Location:
scripts/generate_report.py, lines 713-721 and 784-800
Vulnerability Type: Sensitive-data exposure caused by post-write, non-blocking validation
Risk Level: MediumVulnerable Code
python try: doc.save(output_path) logger.info(f"报告已保存: {output_path}") except PermissionError: raise PermissionError(f"无法写入文件（权限不足或文件被占用）: {output_path}") except OSError as e: raise OSError(f"文件保存失败: {output_path} ({e})") return output_pathThe quality check only detects sensitive information after the document has been saved:
python # 敏感信息检测：代码级防护兜底（IP、AccessKey、密码、密钥等） sensitive_findings = detect_sensitive_data(full_text) if sensitive_findings: for finding in sensitive_findings: results['warnings'].append(f"[敏感信息检测] 报告中发现 {finding}，请确认是否为公开信息，必要时进行脱敏处理") results['sensitive_data_count'] = len(sensitive_findings) logger.info(f"质检结果: {'通过' if results['passed'] else '未通过'}")The command-line workflow also treats sensitive-data findings as informational rather than as a quality-check failure:
python results = quality_check(output_path) if not results['passed']: print("质检未通过，请检查报告内容:") for w in results['warnings']: print(f" - {w}") sys.exit(1) else: print(f"质检通过: {output_path}") if results.get('sensitive_data_count', 0) > 0: print(f"[注意] 检测到 {results['sensitive_data_count']} 类敏感信息，请查看详情")Technical Analysis
Survey data is directly incorporated into the DOCX report. The report is then written to disk before
quality_check()examines its content for AccessKey identifiers, AWS credentials, password fields, public IP addresses, private keys, or JWTs.When sensitive data is found,
quality_check()only appends warnings and setssensitive_data_count. It does not setresults['passed']toFalse, redact the affected values, quarantine the document, or delete the unsafe output. Consequently, the command-line workflow can print that ...[truncated 1568 chars]- Remediation
View remediation
Remediation Suggestions
- Scan the structured survey data before constructing or saving the document.
- Automatically redact detected secrets using type-specific masking, such as preserving only the last four characters of an access key.
- Treat any confirmed sensitive-data finding as a failed quality check by setting
results['passed'] = False. - If post-generation scanning remains necessary, save to a restricted temporary location and atomically publish the document only after validation succeeds.
- Delete or securely quarantine any temporary document that fails sensitive-data validation.
- Add an explicit allowlist mechanism for intentionally public values rather than permitting all findings through as warnings.
- Add regression tests confirming that reports containing access keys, passwords, JWTs, private keys, and public IP addresses are blocked or redacted before delivery.