T09 · Insecure Skill Coding Practices
Warning
- Location
scripts/check_model.py:112- Finding
Persistent Injection of Untrusted Notification Content into Agent Responses
- Content
View full analysis
None: """设置待发送通知（消息中断时使用）""" DATA_DIR.mkdir(parents=True, exist_ok=True) conn = sqlite3.connect(str(DB_PATH)) cursor = conn.cursor() now = datetime.now().isoformat() cursor.execute(''' INSERT INTO model_states (agent_id, last_model, pending_notify, pending_message, updated_at) VALUES (?, ?, 1, ?, ?) ON CONFLICT(agent_id) DO UPDATE SET last_model = excluded.last_model, pending_notify = 1, pending_message = excluded.pending_message, updated_at = excluded.updated_at ''', (agent_id, model, message, now)) conn.commit() conn.close() ``` The persisted text is subsequently selected as the user-facing notification: ```python # 检查是否有待发送通知 has_pending = pending_notify and pending_message # 判断是否首次使用 first_time = previous_model is None # 判断模型是否变化 changed = previous_model != current_model # 判断是否需要通知 should_notify = first_time or changed or has_pending # 生成通知消息 if has_pending: notify_message = pending_message elif first_time: notify_message = f"当前使用模型：{current_model}" elif changed: notify_message = f"老板，模型已切换，当前使用：{current_model}" else: ...[truncated 3003 chars]- Remediation
View remediation
str: if event == "model_switch_interrupted": return f"[Previously unsent] The model has switched. Current model: {model}" raise ValueError("Unsupported notification event") ``` 4. **Validate all stored identifiers and model names.** Enforce reasonable length limits and an allowlist of expected characters. This limits control-character abuse, oversized payloads, and malformed output. 5. **Authenticate and authorize callers.** If the CLI is exposed through an Agent tool or service, ensure only the component responsible for delivery failures can create pending notifications. Do not allow untrusted users to select arbitrary agent identifiers. 6. **Protect the SQLite database.** Create its parent directory and database with restrictive permissions, such as owner-only access, and verify ownership before use. 7. **Treat returned text as untrusted data at the integration boundary.** The Agent should render notifications in a clearly delimited data section and must not interpret notification content as instructions. 8. **Add security tests** confirming that arbitrary custom notification text cannot be persisted, one agent cannot alter another agent's state without authorization, and control characters or oversized values are rejected. ]]>