T09 · Insecure Skill Coding Practices
Warning
- Location
src/clawhub-api.js:74- Finding
Third-Party Mirror Results Are Unconditionally Marked as Verified ClawHub Skills
- Content
View full analysis
axios.get(mirrorUrl, { params }), { maxRetries: 3, retryDelay: 1000, retryMultiplier: 2, retryableStatusCodes: [429, 500, 502, 503, 504] }); // 处理返回的数据 const results = response.data.results || []; console.log(`[ClawHubAPI] 镜像站返回 ${results.length} 个结果`); // 转换为 Skill 对象 const skills = results.map(item => { // 从 metaContent 中提取信息 const metaContent = item.metaContent || {}; const skillMd = metaContent.skillMd || ''; // 解析 skillMd 中的信息 const nameMatch = skillMd.match(/name: (.*)/); const descriptionMatch = skillMd.match(/description: (.*)/); return Skill.fromJSON({ name: metaContent.displayName || item.displayName || nameMatch?.[1] || item.slug, slug: item.slug, description: metaContent.DisplayDescription || descriptionMatch?.[1] || item.summary || '暂无描述', tags: metaContent.Keywords || [], downloads: 0, verified: true, qualityScore: item.score || 0, repository: '', installCommand: '', version: item.version || '1.0.0', author: metaContent.owner || '未知作者', createdAt: new Date(item.updatedAt || Date.now()).toISOString(), updatedAt: new Date(item.updatedAt || Date.now()).toISOString() }); }); ``` The resulting object is subsequently attributed to ClawHub: ```js formatSkill(skill) { const formatted = super.formatSkill(skill); return { ...formatted, source: 'clawhub', sourceUrl: `https://clawhub.ai/skills/${formatted.slug}` }; } ``` ### Technical Analysis Search requests are sent to the third ...[truncated 2188 chars]- Remediation
View remediation