T09 · Insecure Skill Coding Practices
Error
- Location
scripts/compliance_report.py:284- Finding
Unverified invoices are incorrectly reported as verified and normal
- Content
View full analysis
str: """生成第四节：验真结果""" abnormal_records = [ r for r in records if r.verify_status in ("void", "red", "失控", "suspicious", "abnormal") ] if not abnormal_records: return """## 四、验真结果 **异常发票数量**：0 张 **异常发票金额**：¥0.00 ✅ 全部发票状态正常。 """ ``` The Feishu report generator contains equivalent behavior: ```python abnormal_records = [r for r in records if r.verify_status in ("void", "red", "失控", "suspicious", "abnormal")] if not abnormal_records: lines.append("\n全部发票状态正常\n\n") lines.append("**异常发票数量**：0 张 ") lines.append("**异常发票金额**：¥0.00") ``` The tax verification function does not perform verification and leaves the record unchecked: ```python def verify_invoice_tax( record: InvoiceRecord, tier: TierConfig, ) -> tuple[str, str]: allowed, msg = tier.allow_verify() if not allowed: return "unchecked", msg # TODO: 调用国家税务总局增值税发票查验平台 API # 参考: references/tax-api.md # 此处占位，实际接入需要企业纳税人账号 return "unchecked", "国税查验 API 接入占位（待配置企业账号）" ``` ### Technical Analysis The reporting logic treats the absence of a known abnormal status as proof that every invoice is normal. Records with the default `verify_status` value of `unchecked` are excluded from `abnormal_records`. If all records are unchecked, the resulting report states that all invoices are normal. This is a fail-open state-modeling flaw. Verification states should distinguish at least: - Successfully verified as normal - Successfully verified as abnormal - Not verifie ...[truncated 1499 chars]- Remediation
View remediation