T09 · Insecure Skill Coding Practices
- Location
scripts/draft_generator.py:65- Finding
Compliance Checks Are Unconditionally Reported as Passed
- Content
View full analysis
Vulnerability Details
File Location:
scripts/draft_generator.py, lines 65-75 and 102-120
Vulnerability Type: Fail-open validation and fabricated compliance results
Risk Level: HighVulnerable Code
python draft = { '款号': product_id, '标题': product_info.get('title', ''), '类目': product_info.get('category', ''), '属性': product_info.get('attributes', {}), '价格': product_info.get('price', {}), '库存': product_info.get('stock', 100), '图片': product_info.get('images', []), '详情页': product_info.get('detail', ''), '合规校验': '✅ 通过', '生成时间': datetime.now().strftime('%Y-%m-%d %H:%M:%S') }python def _generate_audit_report(self, draft: Dict, product_dir: Path) -> str: """生成终审表""" import pandas as pd audit_dir = product_dir / 'audit' audit_dir.mkdir(parents=True, exist_ok=True) # 创建简单的审计表 data = { '检查项': ['标题合规性', '五维材质一致性', '违禁词检测', '类目正确性', '属性完整性', '价格合规性', '库存合规性'], '状态': ['✅ 通过', '✅ 通过', '✅ 通过', '✅ 通过', '✅ 通过', '✅ 通过', '✅ 通过'], '备注': ['', '', '', '', '', '', ''] } df = pd.DataFrame(data) audit_path = audit_dir / 'audit_report.xlsx' with pd.ExcelWriter(audit_path, engine='openpyxl') as writer: df.to_excel(writer, sheet_name='上架信息终审表', index=False) return str(audit_path)Technical Analysis
The implementation copies untrusted product data directly into the draft and then assigns an unconditional successful compliance status. The audit report similarly marks title compliance, material consistency, prohibited-word detection, category correctness, attribute completeness, price compliance, and inventory compliance as passed without executing any corresponding validation.
This contradicts the documented fail-closed controls, including five-dimensional material consistency checks, minimum price and inventory thresholds, prohibited-word detection, and ...[truncated 1424 chars]
- Remediation
View remediation
Remediation Suggestions
- Implement each advertised check as an explicit validation function with deterministic pass, fail, and error states.
- Validate the input against a strict schema before generating any output.
- Compare normalized material information across the title, attributes, detail page, tag data, and quality report.
- Maintain and enforce a reviewed prohibited-word policy.
- Validate category membership and required attributes against authoritative category metadata.
- Enforce the documented price, discount, SKU price, and inventory limits.
- Load the configuration file and reject startup if mandatory controls are disabled or malformed.
- Fail closed when required evidence is missing or a validator encounters an error.
- Include the evidence, evaluated value, rule identifier, and failure reason for every audit row.
- Never use a successful status as a default value. Generate an overall pass only after every mandatory check succeeds.
- Add automated negative tests covering missing fields, inconsistent materials, prohibited words, invalid prices, and low inventory.