T09 · Insecure Skill Coding Practices
Warning
- Location
skills.md:237- Finding
Security-Relevant Input Validation Uses Removable Python Assertions
- Content
View full analysis
0, "Coordinates cannot be empty" assert 0 <= confidence <= 1, f"Confidence must be in [0,1], got {confidence}" assert observer_id, "Observer ID required" ``` Additional security-relevant checks use the same unsafe pattern: ```python # skills.md:338-340 assert state_hash in self.state_ledger, f"State {state_hash} not found" assert constraint_id in self.constraint_registry, f"Constraint {constraint_id} not found" assert 0 <= severity <= 1, f"Severity must be in [0,1], got {severity}" ``` ```python # skills.md:389-405 assert state_hash in self.state_ledger, f"State {state_hash} not found" state = self.state_ledger[state_hash] coords = state.coordinates assert all(0 <= d < len(coords) for d in target_dims), \ f"Invalid target dimensions {target_dims} for {len(coords)}D state" if projection_type == "orthogonal": projected = [coords[i] for i in target_dims] else: raise ValueError(f"Unknown projection type: {projection_type}") assert self._estimate_entropy(projected) <= self._estimate_entropy(coords), \ "Entropy increased during projection!" ``` ### Technical Analysis Python assertions are debugging constructs, not reliable runtime validation. Running the interpreter with optimization enabled, such as `python -O`, removes all `assert` statements. Consequently, the documented implementation may accept empty coordinate arrays, invalid confidence or severity values, and empty observer identifiers. Checks that references exist and projection dimensions are valid are also removed. This conflicts with the document's characterization of the implementation as production-ready. The same design is duplicated in the whitepap ...[truncated 1255 chars]- Remediation
View remediation