T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/analyze.py:819- Finding
Raw Claude Code conversation content is persisted in plaintext analysis reports
- Content
View full analysis
list[dict]: """Extract representative conversation snippets for Claude to analyze. Picks diverse samples: longest, shortest, most frustrated, most efficient, etc. Truncates messages to keep token usage reasonable. """ if not sessions: return [] snippets = [] selected_ids = set() def add_snippet(s, reason, max_msgs=15): if s["session_id"] in selected_ids: return selected_ids.add(s["session_id"]) # Get user messages (truncated) user_msgs = [] for msg in s["user_messages"][:max_msgs]: user_msgs.append({ "text": msg["text"][:500], # Truncate long messages "timestamp": msg.get("timestamp"), }) # Get first message (full, up to 800 chars) — important for goal clarity first_msg = s["user_messages"][0]["text"][:800] if s["user_messages"] else "" # Get last 3 messages (for completion detection) last_msgs = [] for msg in s["user_messages"][-3:]: last_msgs.append(msg["text"][:300]) # Frustration moments (full context) frustration_moments = [] for i, msg in enumerate(s["user_messages"]): if contains_signal(msg["text"], FRUSTRATION_SIGNALS_STRONG) or contains_signal(msg["text"], FRUSTRATION_SIGNALS_MILD): context = { "user_msg": msg["text"][:400], "position": f"turn {i + 1}/{s['user_msg_count']}", } ...[truncated 5447 chars]- Remediation
View remediation