T09 · Insecure Skill Coding Practices
Error
- Location
pipeline/01_parse.py:177- Finding
User-selected input is ignored, causing unintended private-chat transmission
- Content
View full analysis
bool: script_name, label = STAGES[stage_num] script_path = PIPELINE_DIR / script_name emit(f"STAGE:{stage_num}:START", label) env = os.environ.copy() env["SOUL_FORGE_SOURCE"] = str(source_file) env["SOUL_FORGE_OUTPUT"] = str(OUTPUT_DIR) env["PYTHONPATH"] = str(PIPELINE_DIR) cmd = [sys.executable, str(script_path)] if extra_args: cmd.extend(extra_args) result = subprocess.run(cmd, env=env, text=True) ``` `pipeline/01_parse.py:177-190`: ```python raw_dir = DATA_DIR / "raw" if not raw_dir.exists() or not any(raw_dir.iterdir()): print(f"\n⚠ 请将微信导出文件放入：{raw_dir}") print(" 然后在 pipeline/config.py 中设置正确的 EXPORT_FORMAT 和 SPEAKERS") sys.exit(1) if EXPORT_FORMAT not in PARSERS: print(f"✗ 未知格式：{EXPORT_FORMAT}") sys.exit(1) parser_fn, exts = PARSERS[EXPORT_FORMAT] files = [f for f in raw_dir.rglob("*") if f.suffix.lower() in exts] if not files: print(f"✗ 在 {raw_dir} 中未找到 {exts} 文件") sys.exit(1) ``` `pipeline/03_extract.py:41-57`: ```python def build_request(chunk: dict, prompt_template: str) -> dict: text = chunk["text"] chunk_id = chunk["chunk_id"] time_range = f"{chunk['start_time']} ~ {chunk['end_time']}" prompt = ( prompt_template .replace("{{CHAT_TEXT}}", text) .replace("{{CHUNK_ID}}", str(chunk_id)) .replace("{{TIME_RANGE}}", time_range) ) return { "custom_id": f"chunk-{chunk_id}", "params": { "model": EXTRACT_MODEL, "max_tokens": 4096, "messages": [{"role": "us ...[truncated 2428 chars]- Remediation
View remediation