T09 · Insecure Skill Coding Practices
Warning
- Location
fetch_ai_news_improved.py:153- Finding
Untrusted RSS Content Is Emitted Without Safe Markdown or URL Handling
- Content
View full analysis
]+>", "", summary).strip() ``` ```python for orig, trans in items: lines.append(f"**{trans['title']}**") if trans["summary"]: lines.append(f"> {trans['summary'][:200]}") if orig["link"]: lines.append(f"🔗 [原文链接]({orig['link']})") lines.append("") ``` ```python # 输出到 stdout（供 OpenClaw 读取） print(digest) ``` ### Technical Analysis Article titles, summaries, and links originate from remote RSS feeds and must therefore be treated as attacker-controlled input. The implementation removes HTML-like tags from summaries using a regular expression, but it does not: - Escape Markdown metacharacters in titles or summaries. - Prevent crafted content from terminating or restructuring existing Markdown. - Validate the scheme or destination of article URLs. - Delimit remote content as untrusted data before printing it for OpenClaw consumption. - Neutralize instruction-like text that could influence a downstream AI agent. The HTML-removal expression is not a general-purpose sanitizer and does not address Markdown injection. A malicious feed entry could insert headings, links, images, misleading formatting, or instruction-like content into `latest_digest.md` and stdout. The original link is interpolated directly into Markdown, allowing arbitrary schemes or deceptive destinations if supplied by the feed. This is especially relevant because the comment explicitly identifies stdout as an interface consumed by OpenClaw. If the downstream agent interprets fetched article text as instructions rather than inert content, the flaw can become an ind ...[truncated 1588 chars]- Remediation
View remediation