Skip to content
Report library
Purpose / Other

Error Handling Patterns Skill Security Audit

What the author says it does (original text)

Master error handling patterns across languages including exceptions, Result types, error propagation, and graceful degradation to build resilient applications. Use when implementing error handling, designing APIs, or improving application reliability.

Independent security check

Security risks found

Files checked
2
Risks found
3
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.Risks found: 1
Medium risk

The generic retry decorator defaults to all exceptions and can repeat side effects

Source references: 3
What we found

The reference implementation catches Exception by default and invokes any supplied function again after failure. It does not distinguish transient faults from validation failures or check whether the operation is idempotent.

Why this matters

If an agent applies it to charging, writes, messaging, or resource creation, a successful first operation followed by a failed response could cause duplicate charges, records, or notifications.

The decorator defaults to catching Exception and invokes the supplied function again after failure, which can repeat non-idempotent effects such as charges, writes, or messages. The shown usage narrows retries to NetworkError, reducing risk in that particular example, but the broad default remains available. The risk occurs if users retain the default or wrap non-idempotent operations; they can require explicit transient-error classes and idempotency safeguards.

references/details.md:77In the instructionsOpen original file
def retry(    max_attempts: int = 3,    backoff_factor: float = 2.0,    exceptions: tuple = (Exception,)):    """Retry decorator with exponential backoff."""    def decorator(func: Callable[..., T]) -> Callable[..., T]:        @wraps(func)        def wrapper(*args, **kwargs) -> T:            last_exception = None            for attempt in range(max_attempts):                try:                    return func(*args, **kwargs)                except exceptions as e:                    last_exception = e                    if attempt < max_attempts - 1:                        sleep_time = backoff_factor ** attempt                        time.sleep(sleep_time)                        continue                    raise            raise last_exception
Show 2 other places
references/details.md:87In the instructionsOpen original file
            last_exception = None            for attempt in range(max_attempts):                try:                    return func(*args, **kwargs)                except exceptions as e:                    last_exception = e                    if attempt < max_attempts - 1:                        sleep_time = backoff_factor ** attempt                        time.sleep(sleep_time)                        continue                    raise            raise last_exception
references/details.md:101In the instructionsOpen original file
# Usage@retry(max_attempts=3, exceptions=(NetworkError,))def fetch_data(url: str) -> dict:    response = requests.get(url, timeout=5)    response.raise_for_status()    return response.json()
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.Risks found: 1
Medium risk

Logging advice may expose sensitive data through stack traces, metadata, and exception text

Source references: 4
What we found

The guide explicitly recommends retaining stack traces and metadata and demonstrates logging exception text alongside an order ID. Exceptions, stacks, and business identifiers can contain personal data, tokens, query contents, or third-party responses.

Why this matters

If the application forwards this material to centralized logging or monitoring, people or services with log access may see user or account data that should not have been disclosed.

The skill recommends preserving stack traces and metadata and demonstrates logging an order ID together with exception text. If exceptions or metadata contain tokens, personal data, queries, or third-party responses, that material could enter logs and become visible to log readers. The snippet is not automatically executed, so the risk arises only if the pattern is adopted without redaction. Users can ask for allowlisted fields, redaction, and production stack-trace limits.

SKILL.md:59In the instructionsOpen original file
1. **Fail Fast**: Validate input early, fail quickly2. **Preserve Context**: Include stack traces, metadata, timestamps3. **Meaningful Messages**: Explain what happened and how to fix it4. **Log Appropriately**: Error = log, expected failure = don't spam logs5. **Handle at Right Level**: Catch where you can meaningfully handle
Show 3 other places
SKILL.md:83In the instructionsOpen original file
        # Process payment        try:            payment_result = payment_service.charge(order.total)        except PaymentServiceError as e:            # Log and wrap external service error            logger.error(f"Payment failed for order {order_id}: {e}")            raise ExternalServiceError(                f"Payment processing failed",                service="payment_service",                details={"order_id": order_id, "amount": order.total}            ) from e
SKILL.md:60In the instructionsOpen original file
1. **Fail Fast**: Validate input early, fail quickly2. **Preserve Context**: Include stack traces, metadata, timestamps3. **Meaningful Messages**: Explain what happened and how to fix it
SKILL.md:85In the instructionsOpen original file
            payment_result = payment_service.charge(order.total)        except PaymentServiceError as e:            # Log and wrap external service error            logger.error(f"Payment failed for order {order_id}: {e}")            raise ExternalServiceError(                f"Payment processing failed",                service="payment_service",                details={"order_id": order_id, "amount": order.total}            ) from e
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.Risks found: 1
Medium risk

The exchange-rate fallback can silently substitute a fixed value in financial decisions

Source references: 2
What we found

The example tries two APIs and a cache, then uses DEFAULT_RATE. Its helper catches every exception and returns None, with no alert, freshness check, or validation of the default's source.

Why this matters

If used for settlement, pricing, reporting, or purchasing decisions, an outage may be presented as a valid exchange rate, producing incorrect amounts, margin loss, or misleading financial results.

The exchange-rate example falls through to DEFAULT_RATE when two providers and the cache produce no truthy value, while its helper suppresses every exception by returning None. If used for pricing, settlement, or financial displays, users could make decisions without knowing that the data failed or is stale. This is only an instructional example and does not prove use in real transactions; users can require provenance, expiry, alerts, and a prohibition on settlement use.

references/details.md:502In the instructionsOpen original file
# Multiple fallbacksdef get_exchange_rate(currency: str) -> float:    return (        try_function(lambda: api_provider_1.get_rate(currency))        or try_function(lambda: api_provider_2.get_rate(currency))        or try_function(lambda: cache.get_rate(currency))        or DEFAULT_RATE    )def try_function(func: Callable[[], Optional[T]]) -> Optional[T]:    try:        return func()    except Exception:        return None```
Show 1 other places
references/details.md:511In the instructionsOpen original file
def try_function(func: Callable[[], Optional[T]]) -> Optional[T]:    try:        return func()    except Exception:        return None```

Inside this skill

5 instruction sections

This Skill is a documentation guide for error-handling patterns; its main file directs the agent to read the bundled detailed reference only when the overview is insufficient. The supplied content contains no installation step, command-execution requirement, or credential request.

View source
SKILL.md:53In the instructionsOpen original file
## Detailed patterns and worked examplesDetailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient.

The detailed reference contains copyable Python, TypeScript, Rust, and Go examples, plus retry, circuit-breaker, error-aggregation, and degradation patterns. These are examples rather than scripts that the Skill itself automatically executes.

View source
references/details.md:3In the instructionsOpen original file
## Language-Specific Patterns### Python Error Handling**Custom Exception Hierarchy:**```pythonclass ApplicationError(Exception):
references/details.md:346In the instructionsOpen original file
## Universal Patterns### Pattern 1: Circuit BreakerPrevent cascading failures in distributed systems.```pythonfrom enum import Enum
Start here · InstructionsSKILL.md
error-handling-patterns
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 1
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • references/details.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • SKILL.mdInstructions
  • references/details.mdSupporting file

Operations mentioned in code and instructions

Read files
SKILL.md:55In the instructionsOpen original file
Detailed pattern documentation lives in `references/details.md`. Read that file when the navigation tier above is insufficient.
references/details.md:239In the instructionsOpen original file
// Result type for operations that can failfn read_file(path: &str) -> Result<String, io::Error> {    let mut file = File::open(path)?;  // ? operator propagates errors
references/details.md:240In the instructionsOpen original file
fn read_file(path: &str) -> Result<String, io::Error> {    let mut file = File::open(path)?;  // ? operator propagates errors    let mut contents = String::new();
Connect to websites
references/details.md:104In the instructionsOpen original file
def fetch_data(url: str) -> dict:    response = requests.get(url, timeout=5)    response.raise_for_status()
references/details.md:216In the instructionsOpen original file
function fetchData(url: string): Promise<Data> {  return fetch(url)    .then((response) => {
Lines read
639
File checksum (to compare versions)
3877cbb4f52ffba95ec4695fd8aeed454a2863b9d74c72a86b37224b1bdbfb00