T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/browser_operator.py:347- Finding
Personal Contact Data Is Collected, Stored in Plaintext, and Optionally Relayed to Telegram
- Content
View full analysis
list[str]: return sorted(set(match.group(0).strip() for match in CONTACT_RE.finditer(text or ''))) ``` ```python def notify(cfg: dict[str, Any], text: str) -> None: telegram = cfg.get('telegram') or {} if not telegram.get('enabled'): return target = str(telegram.get('target') or '').strip() if not target: return cmd = ['openclaw', 'message', 'send', '--channel', str(telegram.get('channel') or 'telegram'), '--target', target, '-m', text] account = str(telegram.get('account') or '').strip() if account: cmd.extend(['--account', account]) subprocess.run(cmd, check=False, capture_output=True, text=True, timeout=30) ``` ```python item['score'] = score_candidate(item['text']) item['contactSignals'] = detect_contacts(item['text']) item['replyText'] = build_public_reply(item['text'], website_url) drafts.append(item) drafts.sort(key=lambda row: (row.get('score') or 0, row.get('tweetId') or ''), reverse=True) for item in drafts[:max_replies]: if item['contactSignals']: notify(cfg, f'☎️ Browser contact signal: {item["url"]} | {", ".join(item["contactSignals"][:3])}') if apply and allow_public_reply: item['sendResult'] = post_reply(session, item['url'], item['replyText']) item['applied'] = True applied.append(item['tweetId']) state.mark_replied(item['tweetId']) ...[truncated 2496 chars]- Remediation
View remediation