T09 · Insecure Skill Coding Practices
Warning
- Location
- fetch_ai_news_improved.py:153
- Finding
- Untrusted RSS Content Is Emitted Without Safe Markdown or URL Handling<![CDATA[ ## Vulnerability Details **File Location**: `fetch_ai_news_improved.py:153-157, 217-221, 256` **Vulnerability Type**: Untrusted content injection into Markdown and agent-facing output **Risk Level**: Medium ### Vulnerable Code ```python title = entry.get("title", "无标题") link = entry.get("link", "") summary = entry.get("summary", entry.get("description", "")) # 清理 HTML 标签 summary = re.sub(r"<[^>]+>", "", summary).strip() ``` ```python for orig, trans in items: lines.append(f"**{trans['title']}**") if trans["summary"]: lines.append(f"> {trans['summary'][:200]}") if orig["link"]: lines.append(f"🔗 [原文链接]({orig['link']})") lines.append("") ``` ```python # 输出到 stdout（供 OpenClaw 读取） print(digest) ``` ### Technical Analysis Article titles, summaries, and links originate from remote RSS feeds and must therefore be treated as attacker-controlled input. The implementation removes HTML-like tags from summaries using a regular expression, but it does not: - Escape Markdown metacharacters in titles or summaries. - Prevent crafted content from terminating or restructuring existing Markdown. - Validate the scheme or destination of article URLs. - Delimit remote content as untrusted data before printing it for OpenClaw consumption. - Neutralize instruction-like text that could influence a downstream AI agent. The HTML-removal expression is not a general-purpose sanitizer and does not address Markdown injection. A malicious feed entry could insert headings, links, images, misleading formatting, or instruction-like content into `latest_digest.md` and stdout. The original link is interpolated directly into Markdown, allowing arbitrary schemes or deceptive destinations if supplied by the feed. This is especially relevant because the comment explicitly identifies stdout as an interface consumed by OpenClaw. If the downstream agent interprets fetched article text as instructions rather than inert content, the flaw can become an ind ...[truncated 1588 chars]
- Remediation
- <![CDATA[ ## Remediation Suggestions 1. Escape Markdown metacharacters in all untrusted titles and summaries before interpolation. 2. Normalize or remove control characters and bidirectional text-control characters. 3. Parse article URLs and enforce an explicit allowlist of schemes, preferably only `https`. 4. Consider restricting links to expected feed domains or clearly displaying the normalized destination hostname. 5. Reject malformed URLs, embedded credentials, and dangerous schemes such as `javascript:`, `data:`, and `file:`. 6. Clearly delimit fetched material as untrusted external content. 7. Ensure the consuming agent is instructed to treat digest entries strictly as data and never as executable instructions. 8. Where practical, use a structured output format such as JSON between the fetcher and the agent, and render Markdown only at the final presentation boundary. 9. Add tests using titles, summaries, and URLs containing Markdown delimiters, fake headings, nested links, control characters, and instruction-like payloads. ]]>