From 5575411f7b472b09f865abe0fce685216ab4e00e Mon Sep 17 00:00:00 2001 From: anupamme Date: Sun, 30 Aug 2026 06:14:09 +0000 Subject: [PATCH] fix: V-001 security vulnerability Automated security fix generated by OrbisAI Security --- skills/xmemo/scripts/xmemo-skill.mjs | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/skills/xmemo/scripts/xmemo-skill.mjs b/skills/xmemo/scripts/xmemo-skill.mjs index 6cf27ae..8cc8fd6 100644 --- a/skills/xmemo/scripts/xmemo-skill.mjs +++ b/skills/xmemo/scripts/xmemo-skill.mjs @@ -290,7 +290,7 @@ function validateCommandInput(command, subcommand, positionals, options, flags) ? AUTH_FLAGS[subcommand] || new Set() : COMMAND_FLAGS[command] || new Set(); for (const key of Object.keys(flags)) { - if (/^(token|api[-_]?key|bearer|authorization|cookie|secret)$/i.test(key) && key !== 'from-stdin') { + if (/^(token|api[-_]?key|bearer|authorization|cookie|secret|password|passwd|credential|client[-_]?secret|refresh[-_]?token|access[-_]?token|private[-_]?key|xmemo[-_]?key)$/i.test(key) && key !== 'from-stdin') { throw new Error(`Refusing sensitive command-line option --${key}. Use XMEMO_KEY or --from-stdin where documented.`); } if (!allowedFlags.has(key)) {