github · Skill_SeekersHEAD

Evidence

# Use iterparse for memory efficiency on large exports

            import xml.etree.ElementTree as ET

            tree = ET.parse(xml_path)  # noqa: S314

            root = tree.getroot()

        except Exception as e:

            logger.warning("Failed to parse entities.xml: %s", e)

Remediation

Use defusedxml in Python (drop-in replacement for stdlib XML modules). In Java, set XMLConstants.FEATURE_SECURE_PROCESSING=true and disable external-DTD features on the factory before parsing.

Evidence

headers={"User-Agent": "SkillSeekers/3.4"},

                        )

                        if sub_resp.status_code == 200:

                            sub_root = ET.fromstring(sub_resp.text)

                            for loc in sub_root.findall(".//sm:url/sm:loc", ns):

                                url = (loc.text or "").strip().split("#")[0]

                                if self.is_valid_url(url):

Remediation

Use defusedxml in Python (drop-in replacement for stdlib XML modules). In Java, set XMLConstants.FEATURE_SECURE_PROCESSING=true and disable external-DTD features on the factory before parsing.

Evidence

if "xml" not in response.headers.get("content-type", ""):

                    continue

                root = ET.fromstring(response.text)

                ns = {"sm": "http://www.sitemaps.org/schemas/sitemap/0.9"}

                # Handle sitemap index (nested sitemaps)

Remediation

Use defusedxml in Python (drop-in replacement for stdlib XML modules). In Java, set XMLConstants.FEATURE_SECURE_PROCESSING=true and disable external-DTD features on the factory before parsing.

Evidence

query = "How do I create a Vue component?"

    console.print(f"\n[yellow]Query:[/yellow] {query}")

    try:

        results = collection.query(

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

field_schema=PayloadSchemaType.KEYWORD

)

print("✅ Collection created with payload indexes")

```

### Step 4: Batch Upload with Progress

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

else:

            print("❌ Invalid choice.")

    except ValueError:

        print("❌ Invalid input.")

def set_default_profile():

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

# Stop if we've read enough

        if total_chars > max_chars:

            print(f"  ℹ Limiting input to {max_chars:,} characters")

            break

    return references

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

query = "useState Hook"

    alpha = 0  # Pure keyword search

    console.print(f"\n[yellow]Query:[/yellow] {query}")

    console.print(f"[yellow]Alpha:[/yellow] {alpha} (pure keyword/BM25)")

    try:

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

for i, query in enumerate(queries, 1):

        print(f"\n{'=' * 60}")

        print(f"Query {i}: {query}")

        print("=" * 60)

        # Run query

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

print(f"\\nRank {{i}} (score={{result.score:.4f}}):")

    print(f"  Category: {{result.payload['category']}}")

    print(f"  File: {{result.payload['file']}}")

    print(f"  Text: {{result.payload['content'][:200]}}...")

# Advanced filtering examples

# Filter by multiple conditions

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

try:

            config.config["resume"]["keep_progress_days"] = int(days_input)

        except ValueError:

            print("⚠️  Invalid input, keeping current value")

    config.save_config()

    print("\n✅ Resume settings updated")

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

else:

            print("❌ Invalid choice.")

    except ValueError:

        print("❌ Invalid input.")

def open_github_token_page():

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

for i, point in enumerate(result[0], 1):

    console.print(f"[bold]{i}. {point.payload['file']}[/bold]")

    console.print(f"   {point.payload['content'][:100]}...\n")

console.print("✅ Query examples completed!")

console.print("\n[yellow]💡 Note:[/yellow] For vector search, add embeddings to points!")

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

console.print(f"[green]Found {len(result[0])} points matching both conditions:[/green]\n")

for i, point in enumerate(result[0], 1):

    console.print(f"[bold]{i}. {point.payload['file']}[/bold]")

    console.print(f"   {point.payload['content'][:100]}...\n")

console.print("✅ Query examples completed!")

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

def _send_console(self, payload: WebhookPayload):

        """Print to console."""

        print(f"\n📢 {payload.event.upper()}: {payload.skill_name}")

        if payload.changes:

            changes = payload.changes

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

if self.agent == "claude":

                print("  💡 CLI agent limit: ~30,000-40,000 characters")

            else:

                print("  💡 Local CLI agents often have input limits; summarizing to be safe")

            print()

            print("  🔧 Applying smart summarization to ensure success...")

            print("     • Keeping introductions and overviews")

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

# Extract results

for result in results:

    print(f"Score: {result.score:.3f}")

    print(f"Category: {result.payload['category']}")

    print(f"Content: {result.payload['content'][:200]}...")

    print()

```

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

query = "guide"

    console.print(f"\n[yellow]Query:[/yellow] {query}")

    console.print(f"[yellow]Filter:[/yellow] category = 'guides' AND type = 'reference'")

    try:

Remediation

Strip C0/C1 control codes before printing user-controlled values. Python: re.sub(r"[\x00-\x08\x0b-\x1f\x7f]", "", s). Prefer a structured logger (json/logfmt) over raw print to stdout.

Evidence

if text:

                try:

                    data = yaml.safe_load(text)

                    desc = data.get("description", "")

                except Exception:

                    pass

            print(f"  {name:<32}  {desc}")

    if user:

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

if result.returncode == 0 and result.stdout.strip():

                return result.stdout.strip()

        except Exception:

            pass

        # Fallback to file modification time

        mtime = config_path.stat().st_mtime

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

descr = child.get("descr")

                        if descr:

                            info["alt_text"] = descr

                            break

            except Exception:

                pass

            images.append(info)

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

# Recreate collection if exists

try:

    client.delete_collection(collection_name)

except:

    pass

client.create_collection(

    collection_name=collection_name,

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.

Evidence

if text:

            try:

                data = yaml.safe_load(text)

                desc = data.get("description", "")

            except Exception:

                pass

        result.append({"name": name, "description": desc, "source": "user"})

    output = yaml.dump(result, default_flow_style=False, sort_keys=False)

Remediation

Log the exception at minimum (`logger.exception(e)`), emit a metric, or re-raise if the error is not recoverable. If you genuinely want to ignore an exception, say so with a comment.