sxh 130a9ab9f0

fix(skillscan): report secrets bound by unpacking and container or conditional literals (#6247) ...

* fix(skillscan): report secrets bound by unpacking and container literals

The AST walk behind secret-env-assignment claims "precision, never less
coverage", but it only read a single assignment target and a bare string
value, so a credential moved into `host, api_key = endpoint, "..."` or
into `api_key = ["..."]` stopped being reported even though the pre-#5648
line sweep still reported the same bytes.

Pair unpacking targets with values positionally (fixed head and tail only,
so a runtime-sized slice names nothing) and assert on each literal a
container or conditional holds, in source order.

* fix(skillscan): distinguish mapping labels from credentials

---------

Co-authored-by: sxh313 <sxh313@users.noreply.github.com>
Co-authored-by: Willem Jiang <willem.jiang@gmail.com>

2026-10-04 11:00:05 +08:00

..

extension-api

feat(extensions): add host-bound Agent run control (#6190)

2026-10-03 21:16:01 +08:00

harness

fix(skillscan): report secrets bound by unpacking and container or conditional literals (#6247)

2026-10-04 11:00:05 +08:00