T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/search_bili_user.py:65- Finding
Untrusted API Profile Data Is Processed and Rendered Without Injection Defenses
- Content
View full analysis
list: items = [] for u in users: items.append({ "uid": u.get("uid", 0), "nickname": u.get("nickname", "").strip(), "avatar": normalize_avatar(u.get("avatar", "")), "description": (u.get("description", "") or "").strip(), "fans_num": u.get("fansNum", 0) or 0, "gender": u.get("gender", 3), "level": u.get("level", 0), "is_living": u.get("isLiving", 0) == 1, "is_uploader": u.get("isUploader", 0) == 1, "live_room_id": u.get("liveRoomId", 0), "space_url": build_space_url(u.get("uid", 0)), }) ``` The related workflow instructs the agent to process these fields: ```markdown 获取到账号列表后，AI 必须根据每个账号的 `nickname`（昵称）和 `description`（简介）自动判断其内容方向 ``` It then requires direct Markdown rendering: ```markdown | 1 | [昵称](space_url) | 105.2w | Lv6 | 男 | 21894129 | 简介文字（超30字截断） | 是 | 单机游戏 | ``` The nickname rule further requires the value to be used directly: ```markdown **昵称规则：** `[昵称](space_url)`；昵称直接使用，不截断 ``` ### Technical Analysis The `nickname` and `description` fields are obtained from an external API and ultimately may contain content controlled by Bilibili account owners. The script copies both values into its JSON output without stripping control characters, applying a strict length limit, escaping Markdown syntax, or assigning an explicit untrusted-data classification. The workflow then requires the AI agent to inspect these values for classification and insert them into Markdown out ...[truncated 2490 chars]- Remediation
View remediation