T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/memory-tuner.py:79- Finding
Unvalidated tracking records can manipulate retention decisions or terminate analysis
- Content
View full analysis
= 3 and re.match(r"\d{4}-\d{2}-\d{2}", parts[0]): rows.append((parts[0][:10], parts[1], parts[2].lower())) ``` ```python for date, key, src in rows: idx = match_key(key, norm_key_map, norm_items) if idx < 0: continue s = stats[idx] w = USE_WEIGHT if src == "use" else SEARCH_GET_WEIGHT s["hits"] += 1 s["score"] += w s["sources"].add(src) d = dt.date.fromisoformat(date) if (today - d).days <= 30: s["hits_30d"] += 1 if (today - d).days <= 90: s["hits_90d"] += 1 if s["last_hit"] is None or d > s["last_hit"]: s["last_hit"] = d ``` ### Technical Analysis Tracking records are accepted when the date field merely begins with a date-shaped string. The implementation does not verify that: - The date is a valid calendar date. - The complete field conforms to the expected format. - The date is not in the future. - The source is one of `search`, `get`, or `use`. - The key is unambiguous and corresponds to an intended memory entry. A value such as `2026-99-99` passes the regular-expression check but raises `ValueError` in `datetime.date.fromisoformat`, terminating the report. A valid future date produces a negative age, which satisfies both `<= 30` and `<= 90`; this makes the associated entry appear recently accessed. Unknown source values are also accepted and counted with `SEARCH_GET_WEIGHT`, because every source other than `use` falls into the default branch. These statistics dete ...[truncated 1889 chars]- Remediation
View remediation
today: continue ``` 4. Enforce an allowlist for event sources: ```python if source not in {"search", "get", "use"}: continue ``` 5. Report malformed and rejected records with file names and line numbers without terminating the entire analysis. 6. Treat tracking records as advisory. Require exact entry verification and explicit confirmation before archival or cleanup. 7. Add tests for invalid dates, future dates, trailing date data, unknown sources, empty keys, and malformed separators. ]]>