T09 · Insecure Skill Coding Practices
Error
- Location
index.ts:67- Finding
Untrusted Session Metadata Controls Cross-Channel Message Forwarding
- Content
View full analysis
0); } ``` The resulting routing metadata is subsequently used to send the reply: ```ts // 1. 检查是否是内部任务 if (!isInternalTask(ctx)) { api.logger?.debug?.("[multi-agent-chat] 非内部任务，跳过"); return; } // 2. 获取来源群信息 const { channel, chatId, accountId } = extractSourceInfo(ctx); if (!chatId) { api.logger?.debug?.("[multi-agent-chat] 无法获取来源群 ID，跳过"); return; } // 3. 获取回复内容 const reply = getFinalReply(event); if (!reply) { api.logger?.debug?.("[multi-agent-chat] 无有效回复，跳过"); return; } // 4. 确定使用的 channel 和 accountId const finalChannel = channel || "telegram"; const finalAccountId = accountId || ctx?.agentId || "default"; // 5. 发送到群里 api.logger?.info?.( `[multi-agent-chat] ${finalAccountId} → ${finalChannel}:${chatId}: ${reply.slice(0, 50)}...` ); // 尝试使用 gateway.rpc if (api.gateway?.rpc) { await api.gateway.rpc("message.send", { channel: finalChannel, accountId: finalAccountId, target: chatId, message: reply }); } // 备选：使用 runtime.message else if (api.runtime?.message?.send) { await api.runtime.message.send({ channel: finalChannel, accountId: finalAccountId, target: chatId, message: reply }); } // 备选：使用 api.message else if (api.message?.send) { await api.message.send({ channel: finalChannel, accountId: finalAccountId, target: chatI ...[truncated 2614 chars]- Remediation
View remediation