T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/fetch.mjs:90- Finding
Untrusted Remote Feed Content Is Passed to Agent-Facing Output Without Sanitization
- Content
View full analysis
{ const link = item.link ? ` [原文](${item.link})` : ''; lines.push(`- **${item.title}** (${item.source})${link}`); }); lines.push(''); } } ``` ```javascript // scripts/fetch.mjs:117-131 const telegram = d['/api/telegram-feed?limit=50']; if (telegram?.data?.items?.length) { lines.push('## Telegram OSINT\n'); telegram.data.items.slice(0, 10).forEach((item) => { const raw = (item.text || item.content || '').replace(/\s+/g, ' ').trim(); const text = raw.slice(0, 120); const channel = item.channel ? `[@${item.channel}] ` : ''; const url = item.url ? ` [原文](${item.url})` : ''; if (text) lines.push(`- ${channel}${text}${url}`); }); lines.push(''); } ``` ```javascript // scripts/fetch.mjs:145-160 if (Array.isArray(first) && first[0]) { lines.push('## Polymarket 预测市场\n'); first.slice(0, 5).forEach((e) => { const q = e.question || e.title || e.markets?.[0]?.question; const slug = e.slug || e.markets?.[0]?.slug; const url = slug ? ` [市场](https://polymarket.com/event/${slug})` : ''; const desc = (e.description || e.markets?.[0]?.description || '').slice(0, 80); const hint = desc ? ` — ${desc.replace(/\n/g, ' ')}...` : ''; if (q) lines.push(`- ${q}${url}${hint}`); }); lines.push(''); } const briefPath = path.join(dataDir, 'intel-brief.md'); fs.writeFileSync(briefPath, lines.join('\n'), 'utf-8'); ``` ```javascript // scripts/query.mjs:221-226 for (const s of sections) { const sho ...[truncated 2938 chars]- Remediation
View remediation