T02 · Agent Memory Poisoning
Error
- Location
scripts/fetch-hotspots.sh:174- Finding
Persistent prompt-injection path through untrusted remote titles
- Content
View full analysis
/dev/null 2>&1; then jq '{platform: "douyin", date: "'$DATE'", time: "'$TIME'", source: "real", data: [.result[] | {rank: .index, title: .name, play_count: .hot, author: "热门创作者"}]} | .data |= .[:10]' "$output.tmp" > "$output" rm -f "$output.tmp" log_info "抖音热搜(真实数据)已保存" return fi fi log_warn "真实API获取失败，使用模拟数据" fi ``` The same data flow exists for the other remote sources: ```bash # scripts/fetch-hotspots.sh:50-56 if [[ "$USE_REAL_API" == "true" ]]; then local url="https://weibo.com/ajax/side/hotSearch" if fetch_url "$url" "$output.tmp"; then if jq -e '.ok' "$output.tmp" > /dev/null 2>&1; then jq '[.data.realtime[] | {rank: .rank, title: .word, heat: .realpos, tag: .icon_desc}] | {platform: "weibo", date: "'$DATE'", time: "'$TIME'", data: .}' "$output.tmp" > "$output" ``` ```bash # scripts/generate-report.sh:71-84 generate_douyin_section() { local latest_file=$(ls -t "$DATA_DIR"/douyin_${DATE}_*.json 2>/dev/null | head -1) if [[ -z "$latest_file" ]]; then echo "⚠️ 未找到抖音热搜数据" return fi echo "## 🎵 抖音热搜 TOP10" echo "" jq -r '.data[] | "\(.rank). \(.title) 🎬 \(.play_count | tostring)播放"' "$latest_file" | head -10 echo " ...[truncated 2906 chars]- Remediation
View remediation