T09 · Insecure Skill Coding Practices
Note
- Location
scripts/check_styles.py:119- Finding
Mandatory validation findings do not cause the validation gate to fail
- Content
View full analysis
OUTLINE[prev] + 1: jumps.append((prev, cur)) if jumps: print(f" [WARN] 标题跳级: {jumps}（如 002 后直接 004，检查是否漏了 003）") else: print(" [PASS] 标题层级连续" + ("（无标题段落）" if not heading_seq else "")) print(f" => {'通过' if ok else '需修正（见上方 FAIL/WARN）'}") return ok ``` ### Technical Analysis The validator detects unstyled paragraphs, prohibited empty paragraphs, and skipped heading levels, but it only prints warnings for these conditions. None of the three branches sets `ok` to `False`. Consequently, `check_document()` can return `True` as long as the required styles are present, even when other mandatory checks fail. The process then exits with status zero because `main()` derives its exit status from that return value. This conflicts with the documented validation policy in `SKILL.md`, which states that any violation must be corrected before delivery. It also makes the exit code unreliable for automated workflows that treat a zero result as proof that all validation requirements passed. ### Attack Path 1. An attacker or malformed document supplies at least one paragraph using each required style, such as `000` and `001`. 2. The same DOCX contains unstyled paragraphs, empty paragraphs, or a heading sequence that skips levels. 3. The validator detec ...[truncated 737 chars]- Remediation
View remediation