T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/digest.py:141- Finding
Untrusted Search Results Are Rendered as Unsanitized Markdown and YAML
- Content
View full analysis
1: sub = parts[1].split("/")[0] source = f"reddit:r/{sub}" elif "news.ycombinator.com" in url: source = "hackernews" elif "github.com" in url: source = "github" # Match signal keywords found in title + snippet text = f"{title} {snippet}".lower() matched = [] all_signals = item.get("signal_keywords", DEFAULT_SIGNAL_KEYWORDS) for kw in all_signals: if kw.lower() in text: matched.append(kw) finding = { "title": title, "url": url, "snippet": snippet, "source": item.get("source", source), "niche": item.get("niche", ""), "date": item.get("date", item.get("age", datetime.now().strftime("%Y-%m-%d"))), "matched_keywords": matched, } findings.append(finding) ``` Untrusted niche values are inserted directly into YAML frontmatter: ```python # YAML frontmatter lines.append("---") lines.append(f"date: {date_str}") lines.append(f"time: {time_str}") lines.append("type: opportunity-scan") niche_yaml = ", ".join(niches) if niches else "general" lines.append(f"niches: [{niche_yaml}]") lines.append(f"find ...[truncated 4402 chars]- Remediation
View remediation