T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/validate_labeling_output.mjs:22- Finding
Fail-Open Workbook Validation Allows Unsupported Formal Labels to Pass QA
- Content
View full analysis
{ const rows = matrices[name] || []; if (rows.length < 2) return []; const headers = rows[0].map(String); return rows.slice(1).filter((r) => r.some((v) => v !== null && v !== "")).map((r) => Object.fromEntries(headers.map((h, i) => [h, r[i] ?? ""]))); }; const duplicates = (values) => [...new Set(values.filter((v, i) => v && values.indexOf(v) !== i))]; const source = objects("Source Data"); const results = objects("Labeling Results"); const evidence = objects("Evidence"); const taxonomy = objects("Taxonomy"); const sourceIds = source.map((r) => String(r.record_id || "").trim()); const resultIds = results.map((r) => String(r.record_id || "").trim()); const duplicateSourceIds = duplicates(sourceIds); const duplicateResultIds = duplicates(resultIds); if (duplicateSourceIds.length) errors.push(`duplicate source record_id: ${duplicateSourceIds.join(", ")}`); if (duplicateResultIds.length) errors.push(`duplicate result record_id: ${duplicateResultIds.join(", ")}`); const dropped = sourceIds.filter((id) => id && !new Set(resultIds).has(id)); const unexpected = resultIds.filter((id) => id && !new Set(sourceIds).has(id)); if (source.length && dropped.length) errors.push(`source records missing results: ${dropped.join(", ")}`); if (unexpected.length) errors.push(`results without source records: ${unexpected.join(", ")}`); const formalPaths = new Set(taxonomy.filter((r) => String(r.status).trim() === "formal" && String(r.output_eligible || "true").toLowerCase() !== "false").map((r) => String(r.label_path).trim())); const allowedStatus = new Set(["formal", "candidate", "unclassified", "needs_review"]); const allowedConfidence = new Set(["high", "medium", "low", ""]); let illegalFormalLabels = 0 ...[truncated 4537 chars]- Remediation
View remediation