T09 · Insecure Skill Coding Practices
Warning
- Location
SKILL.md:96- Finding
Untrusted Job-Posting Content Is Processed Without an Explicit Agent Instruction Boundary
- Content
View full analysis
.json`) y llamá a `python3 scripts/match_jobs.py --profile data/profile.json --config data/config.json --job-file `. **Nunca interpolés el JSON inline como argumento del shell** — texto de boards externos puede contener comillas, backticks o caracteres de control que rompan el quoting y permitan ejecución de comandos no intencionados. - El script devuelve un score 0-100 + rationale + flags (salary_above_target, stack_perfect_match, seniority_mismatch, etc.) 4. Guardá todas las ofertas vistas en `data/seen_jobs.json` (incluso las que no matchean, para no reprocesarlas). ``` Related rendering behavior in `scripts/notify.py`, lines 136-151: ```python def _format_match_card(m: dict, prefix: str = "·") -> str: score = m.get("score", "?") title = m.get("title", "(sin título)") company = m.get("company", "(sin empresa)") flags = m.get("flags") or [] flag_str = f" ⚠ {', '.join(flags)}" if flags else "" rationale = m.get("rationale") or [] why = "; ".join(rationale[:2]) if rationale else "" url = m.get("url") or m.get("job_id", "") return ( f"{prefix} **{score}/100** — {title} @ {company}{flag_str}\n" f" {why}\n" f" {url}" ) ``` ### Technical Analysis The Skill ...[truncated 2733 chars]- Remediation
View remediation