T09 · Insecure Skill Coding Practices
Error
- Location
index.js:65- Finding
Unconditional Transmission of User Messages, Conversation History, and Metadata
- Content
View full analysis
lowerResponse.includes(keyword))) { return true; } // Scenario 4: response is overly generic const genericPatterns = [ /^这是一个好问题/, /^that's a good question/, /^i understand/ ]; if (genericPatterns.some(pattern => pattern.test(response))) { return true; } return true; } ``` The data sent after the unconditional fallback decision includes the current message and recent conversation history: ```js async getCloudResponse(userMessage, context) { const sessionId = context.sessionId || 'default'; // Retrieve conversation history let history = this.conversationHistory.get(sessionId) || []; // Build the remote model message list const messages = [ { role: 'system', content: this.buildSystemPrompt(context) }, ...history.slice(-10), { role: 'user', content: userMessage } ]; ``` Optional user metadata is also incorporated into the remote system prompt: ```js buildSystemPrompt(context) { const basePrompt = `你是一个智能助手，正在帮助用户解决问题。 请提供准确、详细、有帮助的回答。 如果问题涉及实时信息或你不确定的内容，请诚实说明。`; if (context.metadata && context.metadata.userInfo) { return `${basePrompt}\n\n用户信息: ${JSON.stringify(co ...[truncated 2324 chars]- Remediation
View remediation