T09 ยท Insecure Skill Coding Practices
Warning
- Location
- error-handler.js:240
- Finding
- Generated Error Handlers Log Complete Function Arguments## Vulnerability Details **File Location**: `error-handler.js`, lines 240โ272 **Vulnerability Type**: Sensitive data exposure through unsafe logging **Risk Level**: Medium ### Complete Code Snippet ```javascript generateAsyncErrorHandling(name, body, risk) { const errorClass = risk === 'critical' ? 'CriticalError' : risk === 'high' ? 'SecurityError' : risk === 'medium' ? 'DataError' : 'AppError'; return `async function ${name}(...args) { try { // Original logic ${body.trim().split('\n').map(line => ' ' + line).join('\n')} } catch (error) { // Network/timeout errors if (error.name === 'AbortError') { logger.error('${name} timeout', { args }); throw new ${errorClass}('Request timeout', { cause: error }); } if (error.message.includes('fetch failed')) { logger.error('${name} network error', { args, error: error.message }); throw new ${errorClass}('Network error', { cause: error }); } // Re-throw known errors if (error instanceof ${errorClass}) { logger.error('${name} failed', { args, error: error.message }); throw error; } // Unexpected errors logger.error('${name} unexpected error', { args, error }); throw new ${errorClass}('Internal error', { cause: error }); } }`; } generateSyncErrorHandling(name, body, risk) { return `function ${name}(...args) { try { // Original logic ${body.trim().split('\n').map(line => ' ' + line).join('\n')} } catch (error) { logger.error('${name} failed', { args, error: error.message }); throw new Error(\`${name} error: \${error.message}\`, { cause: error }); } }`; } ``` ### Technical Analysis Both generated wrappers capture function parameters through `...args` and write the complete argument array to structured logs whenever an exception occ ...[truncated 2544 chars]
- Remediation
- ## Remediation Suggestions 1. Remove complete argument logging from both templates: ```javascript logger.error('${name} failed', { errorType: error.name, errorCode: error.code }); ``` 2. Use an explicit allowlist of diagnostic fields. Log stable operation names, correlation IDs, non-sensitive resource identifiers, and normalized error codes instead of arbitrary parameters. 3. If object logging is required, apply recursive redaction before values reach the logger. At minimum, redact case-insensitive keys such as: - `password` - `token` - `accessToken` - `refreshToken` - `authorization` - `cookie` - `secret` - `apiKey` - `cardToken` - `creditCard` - `cvv` 4. Do not log raw request objects, headers, database records, payment payloads, or error objects that may contain sensitive response data. Extract only approved properties. 5. Add depth, length, and collection-size limits to any sanitizer to prevent excessive or cyclic objects from reaching the logging backend. 6. Change generated examples in `SKILL.md` to model data-minimizing logging practices, and document that credentials, payment data, and PII must never be logged. 7. Add automated tests that generate wrappers for authentication and payment functions and assert that secrets cannot appear in the resulting log metadata.