other
Warning
- Location
scripts/idea_gen.py:104- Finding
Local Script Filenames Are Disclosed to an External LLM Provider
- Content
View full analysis
str: """列出指定目录下现有的 Python 脚本文件名（用于避免重复造轮子）。 Args: directory: 要扫描的目录路径，默认 ~/.openclaw/workspace-coding-advisor/scripts Returns: 目录下的 .py 文件列表（最多 30 个），目录不存在时返回提示 """ p = Path(os.path.expanduser(directory)) if not p.exists(): return f"目录不存在：{p}" if not p.is_dir(): return f"不是目录：{p}" files = sorted([f.name for f in p.glob("*.py")]) if not files: return f"{p} 下没有 .py 文件" return f"{p} 下现有 {len(files)} 个脚本：\n" + "\n".join(f"- {f}" for f in files[:30]) ``` ```python def plan_node(state: State) -> State: """节点 3：生成 3 行落地（命令→场景→存 scripts/） v1.1 升级： - 调用 list_existing_scripts tool 查老板现有脚本 - 注入 prompt 让 LLM 避免重复造轮子 """ # 调用 tool 查现有脚本（直接调 .func()，M3 tool-calling 支持待验证） existing = list_existing_scripts.func() existing_count = existing.count("- ") # 简单计数 llm = make_llm() prompt = f"""生成 **3 行落地**（每行 ≤ 50 字）： 需求：「{state['request']}」 ({state['category']}/{state['complexity']}) 老板已有脚本： {existing} 格式： 命令：<具体可执行> 场景：<解决什么问题> 文件：~/.openclaw/workspace-coding-advisor/scripts/xxx.py （已有类似请改进，不要重写）""" plan = llm.invoke(prompt).content.strip() ``` ### Technical Analysis The `list_existing_scripts` tool enumerates up to 30 Python filenames from `~/.openclaw/workspace-coding-advisor/scripts`. The resulting list is inserted directly into an LLM prompt and transmitted by `llm.invoke` to the externally configured MiniMax Anthropic-compatible endpoint. Only filenames are collected; file contents and credentials are not read by this code. Nevertheless, filenames can contain sensitive metadata such as customer names, internal project identifiers, operational functions, or references ...[truncated 1312 chars]- Remediation
View remediation