T09 · Insecure Skill Coding Practices
Warning
- Location
- scripts/concept_radar.py:397
- Finding
- Untrusted Feed Metadata Is Published as Unsanitized Markdown## Vulnerability Details **File Location**: `scripts/concept_radar.py`, lines 397–400, 797–798, and 963–966 **Vulnerability Type**: Markdown content injection **Risk Level**: Medium ### Vulnerable Code External RSS item titles are accepted as candidate metadata: ```python rows.append(( "rss:" + (_xml_text(item.find("guid")) or canonical), _xml_text(item.find("title")), body, published, canonical, )) ``` The untrusted title and author name are embedded directly into Markdown link syntax: ```python f"**主出处**\n[{candidate['author_name']}：{candidate['title']}]" f"({candidate['canonical_url']})" ``` The generated Markdown is then sent through the authenticated Feishu CLI: ```python completed = runner([ "lark-cli", "im", "+messages-send", "--user-id", open_id, "--markdown", output_path.read_text(encoding="utf-8"), "--as", "user", "--idempotency-key", idempotency_key, ], capture_output=True, text=True, check=False) ``` ### Technical Analysis RSS and Atom content is supplied by external source operators. The parser preserves source-controlled item titles, and `render_digest` interpolates them into a Markdown link label without escaping Markdown metacharacters. A malicious title containing closing brackets, parentheses, or additional Markdown constructs can terminate the intended link label and introduce attacker-chosen rendered content. The generated document is later passed to `lark-cli` using its Markdown option and published as the authenticated user. Publication is optional and requires an explicit user request, which reduces reachability. However, that authorization only covers publishing the reviewed concept digest; it does not authorize an external feed operator to alter the message structure or inject deceptive content. No escaping or structural encoding is applied at the boundary. ### Attack Path 1. An attacker controls an RSS or Atom source included in the configured author pool. 2. The attacker publishes an item whose title c ...[truncated 1244 chars]
- Remediation
- ## Remediation Suggestions 1. Escape all externally sourced values before inserting them into Markdown, especially: - `candidate["title"]` - `candidate["author_name"]` - Any externally derived labels used in links or headings 2. Implement escaping for the exact Markdown dialect accepted by Feishu, including at minimum backslashes, brackets, parentheses, image markers, and line-breaking characters. 3. Prefer a structured Feishu message API that represents text and links as separate encoded fields rather than concatenating untrusted values into Markdown. 4. Add a final rendered-message preview and approval step before publication so the user can detect unexpected links or formatting. 5. Add regression tests using malicious feed titles that attempt to: - Close the intended link label - Insert a second link - Insert an image - Add mentions or multiline content 6. Ensure tests verify that the resulting document renders the entire external title as inert text and cannot change the surrounding Markdown structure.