T09 · Insecure Skill Coding Practices
Warning
- Location
analyze.py:42- Finding
Hard-Coded Simulated Metrics Presented as Store-Specific Analysis
- Content
View full analysis
Vulnerability Details
File Location:
analyze.py:42-53,analyze.py:62-70,analyze.py:84-92, andanalyze.py:109-117
Vulnerability Type: Hard-coded simulated business data and inadequate input handling
Risk Level: MediumVulnerable Code
python def evaluate_target(store_id: str, month: str = "2026-03") -> EvaluationResult: return EvaluationResult( dimension="Target achievement", current=313226, expected=350000, achievement_rate=89.5, status="Attention", icon="🟡", finding="Achievement rate is 89.5%, with a gap of 36,774" )python def evaluate_mom(store_id: str, current_month: str = "2026-03") -> EvaluationResult: return EvaluationResult( dimension="Month-over-month analysis", current=313226, expected=200000, achievement_rate=156.6, status="Normal", icon="🟢", finding="Month-over-month growth is 56.6%" )python return EvaluationResult( dimension=f"Historical baseline ({weekday_cn})", current=12047, expected=11584, achievement_rate=104.0, status="Normal", icon="🟢", finding="At the historical 52nd percentile" )python return EvaluationResult( dimension=f"Weekend performance ({weekday_name})", current=14267, expected=20366, achievement_rate=70.0, status="Alert", icon="🔴", finding="30% below the Saturday baseline" )Technical Analysis
The evaluation functions accept store identifiers and reporting-period parameters but do not use them to retrieve or calculate store-specific metrics. Instead, they return fixed current values, expected values, achievement rates, statuses, and findings.
comprehensive_evaluationsubsequently associates these fixed results with the caller-suppliedstore_id,store_name, and date. ...[truncated 1730 chars]- Remediation
View remediation
Remediation Suggestions
- Replace hard-coded values with data retrieved through documented, authenticated, and trusted interfaces.
- Validate
store_id, reporting dates, and month parameters before querying or calculating metrics. - Bind every returned metric to the requested store and reporting period.
- Return an explicit error when required source data is unavailable rather than substituting simulated values.
- If demonstration data is required, isolate it behind an explicit test or demo mode and prominently label all resulting output as synthetic.
- Calculate achievement rates and findings from validated source values instead of hard-coding both inputs and conclusions.
- Implement the documented Benchmark dimension or remove that capability from the documentation and report claims.
- Add automated tests proving that different store IDs and reporting periods produce appropriately distinct results.
- Add provenance metadata to reports, including data source, retrieval time, reporting period, and whether any fallback data was used.
- Require human review before generated recommendations can trigger staffing or other consequential operational actions.