T09 · Insecure Skill Coding Practices
Warning
- Location
engine/rules.py:123- Finding
Incomplete Safety Validation and Unbounded Numeric Input Handling
- Content
View full analysis
ValidationResult: """内容安全验证""" errors = [] # 禁止内容关键词 forbidden = ["暴力", "恐怖", "成人", "政治", "violence", "horror", "adult"] theme = params.theme or "" if any(word in theme.lower() for word in forbidden): errors.append(f"主题包含禁止内容: {params.theme}") return ValidationResult(valid=len(errors) == 0, errors=errors) ``` Related unchecked page override: ```python @classmethod def calculate_pages(cls, age: int, override: Optional[int] = None) -> int: """计算页数""" if override: return override config = cls.get_age_config(age) return config["default_pages"] ``` Related unchecked integer conversion and page parsing: ```python params = StoryParams( style=parts[0] if len(parts) > 0 else "storybook", scene=parts[1] if len(parts) > 1 else "meadow", age=int(parts[2]) if len(parts) > 2 else 5, ) ``` ```python for i, part in enumerate(parts[3:], start=3): if part.isdigit(): params.pages = int(part) ``` ### Technical Analysis The documented safety policy states that safety checks are mandatory and must reject numerous categories, including weapons, dangerous activities, political and religious material, commercial or branded material, substances, bullying, and inappropriate relationships. The executable validator does not implement that policy comprehensively. The validator has the following weaknesses: 1. It checks only seven literal substrings. 2. It examines only `params.theme`. 3. It does not inspect action or expression values passed to `assemble_prompt()`. 4. It does not validate supporting-character entries in ...[truncated 2790 chars]- Remediation
View remediation