T09 · Insecure Skill Coding Practices
Error
- Location
lib/normalize.js:99- Finding
Ambiguous and cross-domain commands can bypass confirmation safeguards
- Content
View full analysis
[domainName, domain.deviceAliases || []]), ); const actions = Object.entries(domains).reduce((acc, [, domain]) => { for (const [actionName, aliases] of Object.entries(domain.actions || {})) { acc[actionName] = Array.from(new Set([...(acc[actionName] || []), ...aliases, ...(SHARED_ALIASES.action[actionName] || [])])); } return acc; }, {}); const modes = Object.entries(domains).reduce((acc, [, domain]) => { for (const [modeName, aliases] of Object.entries(domain.modes || {})) { acc[modeName] = Array.from(new Set([...(acc[modeName] || []), ...aliases])); } return acc; }, {}); return { domains, devices, actions, modes }; } ``` `lib/normalize.js:99-150`: ```js function inferAction(text, profile = DEFAULT_PROFILE) { const normalized = normalizeText(text); if (/(つけて|つける|オン)/.test(normalized)) return { value: 'on', alias: 'つけて', score: 0.96, matchedBy: 'rule' }; if (/(消して|けして|オフ|止めて|とめて)/.test(normalized)) return { value: 'off', alias: '消して', score: 0.96, matchedBy: 'rule' }; if (/(にして|して)/.test(normalized)) return { value: 'set_mode', alias: 'にして', score: 0.94, matchedBy: 'rule' }; return findBestAlias(text, profile.actions, 0.72); } function deriveIntent(slots) { if (slots.device === 'light' && slots.action === 'on') return { intent: 'light_on', reason: 'matched light on' }; if (slots.device === 'light' && slots.action === 'off') return { intent: 'light_off', reason: 'matched light off' }; if (slots.device === 'aircon' && slots.action === 'on' && !slots.mode) return { intent: ...[truncated 5233 chars]- Remediation
View remediation