T09 · Insecure Skill Coding Practices
Error
- Location
scripts/screen-activity.sh:61- Finding
Advertised sensitive-application blacklist is disabled
- Content
View full analysis
/dev/null || echo "未知") # for keyword in "${APP_BLACKLIST[@]}"; do # if echo "$FRONT_APP" | grep -qi "$keyword"; then # echo "SKIP: app '$FRONT_APP' matches blacklist keyword '$keyword'" # # Log text-only entry # DATE=$(date "+%Y-%m-%d") # TIME=$(date "+%H:%M") # if [ "$BACKEND" = "siyuan" ]; then # python3 "$SCRIPT_DIR/siyuan-logger.py" "NONE" "$DATE" "$TIME" "$FRONT_APP 正在使用中（黑名单跳过截图）" 2>/dev/null # else # echo "- **$TIME** $FRONT_APP 正在使用中（黑名单跳过截图）" >> "$OUTPUT_DIR/$DATE.md" # fi # exit 0 # fi # done ``` ### Technical Analysis The complete foreground-application blacklist implementation is commented out. Although `setup.py` creates default exclusions for banking, password, payment, and login applications, those exclusions are never enforced. Execution therefore continues into the screenshot block at `scripts/screen-activity.sh:80-95`, which captures the entire screen regardless of the active application. This contradicts the privacy guarantees in `README_EN.md:22` and `README_EN.md:73-77`. The screen capture permission is necessary for the declared tracking functionality, but capturing explicitly excluded applications exceeds the privacy boundary represented to the user. ### Attack Path 1. The user configures or accepts the default application blacklist. 2. The user opens a password manager, banking application, authentication prompt, or another excluded application. 3. The persistent tracking cron job invokes `screen-activity.sh`. 4. The commented blacklist code perf ...[truncated 974 chars]- Remediation
View remediation