T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/competitor_ai_analyzer.py:68- Finding
Untrusted competitor content is directly embedded in an LLM instruction prompt
- Content
View full analysis
tuple[str, str]: """通过 jina.ai reader 获取页面文本。返回 (text, jina_url)。""" jina_url = f"https://r.jina.ai/{url}" text = _http_get(jina_url) return text, jina_url ``` ```python def _build_prompt(competitor_name: str, raw_text: str, source_type: str, brand_summary: str) -> str: """构建竞品分析 prompt。""" return f"""你是品牌竞争情报分析师。分析以下竞品公开内容，提取营销信号。 竞品名称：{competitor_name} 品牌背景（你的品牌，作为参照）：{brand_summary} 竞品原始内容（来源：{source_type}）： {raw_text} 请用 JSON 格式输出，只含以下字段（全英文，不要中文值）： {{ "theme": "主题定位（1-3英文词，如 minimalism / productivity-platform / lifestyle-brand）", "tone": "内容语气（2-4英文词）", "frequency": "内容频率估计（daily/weekly/irregular）", "hooks": ["钩子1", "钩子2", "钩子3"], "content_patterns": ["模式1", "模式2", "模式3"], "channel_strength": ["渠道1", "渠道2"], "gaps": ["弱点/差异化机会1", "弱点2"] }} 只输出 JSON，不要其他说明文字。""" ``` ```python prompt = _build_prompt(competitor_name, raw_text, source_type, brand_summary) try: llm_response = llm_complete( prompt=prompt, model=ANALYSIS_MODEL, max_tokens=ANALYSIS_MAX_TOKENS, ) analysis = _parse_llm_json(llm_response, competitor_name) ``` ### Technical Analysis The workflow retrieves content controlled by competitor websites or search-result publishers and places it directly into the same prompt that contains the model's operational instructions. There is no strong trust-boundary declaration, instruction-conflict policy, content encoding, or preprocessing step that removes instruction-like text. An attacker controlling a fetched page can insert text such as instructions to ignore t ...[truncated 2319 chars]- Remediation
View remediation