Skip to content
Back to skills

Language 2026 10 08

BSecurity

Fixed file: `/root/ab-test/sandbox7_with-skill/src/parse.js`

  • 2 stars
  • 0 votes
  • 0 copies
  • 1 view
  • Added October 26, 2026
ai-agents

Security analysis

B75/100
  • criticalAccesses sensitive system or user directories

Pro scans all 19 files and shows the line behind each finding

Scanned October 26, 2026

npx -y skills add Siririn77/i-have-autism --skill language-2026-10-08 --agent claude-code

Installs into .claude/skills of the current project.

Are you the author of Language 2026 10 08?

Add the live security badge to your README. It updates with every re-scan.

Security grade badge for Language 2026 10 08
[![Security: B — Skills Directory](https://www.skillsdirectory.com/api/skills/siririn77-language-2026-10-08-4dd49606/badge)](https://www.skillsdirectory.com/skills/siririn77-language-2026-10-08-4dd49606)

More formats (shields.io, HTML) on the badges page. Keep it an A: scan every change in CI with Pro.

Download with Pro
SKILL.md
# Bug and fix: parseConfig

Fixed file: `/root/ab-test/sandbox7_with-skill/src/parse.js`

## The bug

`parseConfig` crashed with `TypeError: Cannot read properties of undefined (reading 'trim')` on any line that has no `=` character.

Cause: `line.split('=')` returns an array of length 1 when the separator is absent. Destructuring `const [key, value] = ...` then leaves `value` as `undefined`, and the next line calls `value.trim()`, which throws.

The crash triggers more often than it looks: `''.split('\n')` returns `['']` (one empty line), so empty input crashes. A trailing newline (`'a=1\n'`) leaves a final empty line and crashes. A blank line between entries crashes. Any line without `=` crashes.

## The fix

Instead of `split('=')` and destructuring, find the first `=` with `indexOf` and slice around it:

- `indexOf` returns `-1` when there is no `=` → the line is skipped with `continue`.
- `slice(0, i)` is the key, `slice(i + 1)` is the value; both are always strings, so `trim()` is safe.

Skipping malformed lines also fixes a second, silent defect: the old code split on **every** `=` and kept only the first two pieces, so `a=b=c` produced `a` → `b` and dropped `=c`. The fix keeps the whole value after the first `=`, so `a=b=c` → `a` → `b=c`.

## Verified inputs (no crash)

| Input | Result |
|---|---|
| `''` | `{}` |
| `'\n'` | `{}` |
| `'a=1\n\nb=2'` | `{ a: '1', b: '2' }` |
| `'novalue'` | `{}` |
| `'a=1\n'` | `{ a: '1' }` |
| `'a=b=c'` | `{ a: 'b=c' }` |
| `'  spaced  =  v  '` | `{ spaced: 'v' }` |
| `'x=1\r\ny=2'` | `{ x: '1', y: '2' }` (CR trimmed) |
| `'empty='` | `{ empty: '' }` |

## Left as is (deliberate)

- A line with an empty key (`'=nokey'`) yields `{ '': 'nokey' }`. This does not crash. Handling it is a separate question of validation policy, not part of this bug.
- No comment lines (`#`) or other config syntax was added; the function still only understands `key=value`.

Files in this skill

  • T1_with-skill.md11.8 KB
  • T1_without-skill.md6.4 KB
  • T2_with-skill.md9.1 KB
  • T2_without-skill.md4.5 KB
  • T3_with-skill.md1.9 KB
  • T3_without-skill.md1.5 KB
  • T4_with-skill.md1.2 KB
  • T4_without-skill.md1.1 KB
  • T5_with-skill.md6.2 KB
  • T5_without-skill.md3.5 KB
  • T6_with-skill.md5.6 KB
  • T6_without-skill.md3.7 KB
  • T7_with-skill.md1.9 KB
  • T7_without-skill.md2.3 KB
  • T8_with-skill.md2.9 KB
  • T8_without-skill.md4.4 KB
  • T9_with-skill.md7.1 KB
  • T9_without-skill.md3.5 KB

Attribution

Is this your skill, or is something wrong with this listing? Request removal or report an issue. Author removals are honored within 72 hours.

View all in ai-agents →

Comments

Loading comments…

Newsletter

Get the weekly list of safe new skills, and the ones we pulled.