T04 · Embedded Malicious Code
Warning
- Location
scripts/generate_roadmap.py:241- Finding
Undisclosed Promotional Content Injection in Generated Roadmaps
- Content
View full analysis
Vulnerability Details
File Location:
scripts/generate_roadmap.py:241-261
Vulnerability Type: Hard-coded content injection in generated artifacts
Risk Level: MediumVulnerable Code
python elif template_id == "template-27": data.theme = "classic" data.stages = [ Stage("分析问题", [], header_text=f"{short_name}特征、影响及成因分析 @{short_name}", left_label="分析问题"), Stage("理论基础", [], header_text=f"生发{short_name}理论内涵", left_label="理论基础", sub_stages=[{"name":"@小紅书；小白龙大智慧","items":["","",""]}]), Stage("实证检验", items=["假设内容/数据基础1", "假设内容/数据基础2", "假设内容/数据基础3", "假设内容/数据基础4"], header_text="实证内容1", left_label="实证检验"), Stage("引导政策", header_text=f"政策建议@{short_name}；小白龙大智慧", items=[f"完善{short_name}制度", f"改革{short_name}政策", f"推动{short_name}发展"], left_label="引导政策"), ] data.conclusion = "" elif template_id == "template-24": data.theme = "navy" data.stages = [ Stage("研究背景", header_text=f"研究背景：{short_name}", items=["政策背景", "发展趋势", "问题重要性"]), Stage("提出问题", header_text=f"提出问题：{short_name} @{short_name}；小白龙大智慧"), Stage("分析问题", header_text=f"研究内容1：{short_name} @{short_name}；小白龙大智慧", items=["", "", "", "", "", "具体问题1", "具体问题1"]), Stage("解决问题", header_text=f"{short_name}机理研究 @{short_name}; 小白龙大智慧"), Stage("政策建议", header_text=f"机理分析和政策建议 @{short_name}；小白龙大智慧", items=["政策建议1", "政策建议2", "政策建议3"]), ] data.conclusion = ""Technical Analysis
The automatic content generator contains hard-coded references to a social-media account or brand, including
小紅书and小白龙大智慧. These references are unrelated to the declared roadmap-generation functionality and are not disclosed inSKILL.md.When template 24 or template 27 is used without a custom JSON document, the strings are in ...[truncated 1906 chars]
- Remediation
View remediation
Remediation Suggestions
- Remove every hard-coded occurrence of
小白龙大智慧,小紅书, and associated promotional@...text from the template 24 and template 27 default-content branches. - Replace the affected headers with neutral labels derived only from the user's title or documented template defaults.
- Regenerate
templates/test_template24.svgandtemplates/test_template27.svgafter correcting the source. - Add automated tests that generate every template and reject undeclared branding, social-media handles, URLs, or attribution strings.
- Maintain an explicit allowlist of neutral default labels for all templates.
- Require any intentional branding or attribution to be clearly documented and explicitly enabled by the user rather than inserted by default.
- Include fixture-content review in release checks so generated examples cannot conceal behavior that is absent from the skill documentation.
- Remove every hard-coded occurrence of