T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fundamental.mjs:89- Finding
Untrusted Remote News Content Is Passed to the Agent Without an Explicit Trust Boundary
- Content
View full analysis
({ title: a.title, date: a.date, url: a.url })); } catch { return []; } } ``` ```javascript export async function analyzeNewsSentiment(symbol) { const news = await fetchNews(symbol); const recentHeadlines = news.slice(0, 5).map(n => n.title).filter(Boolean); const positiveWords = ['涨', '盈利', '突破', '利好', '增长', '超预期', '上调', '创新高', '大涨', '买入', '领涨', '飙升']; const negativeWords = ['跌', '亏损', '下跌', '利空', '下滑', '不及预期', '下调', '创新低', '大跌', '卖出', '暴跌', '减持']; let score = 0; for (const title of recentHeadlines) { for (const w of positiveWords) if (title.includes(w)) score += 0.2; for (const w of negativeWords) if (title.includes(w)) score -= 0.2; } score = Math.max(-1, Math.min(1, score)); return { overall: score > 0.2 ? 'positive' : score < -0.2 ? 'negative' : ' ...[truncated 2248 chars]- Remediation
View remediation