T09 · Insecure Skill Coding Practices
Error
- Location
scripts/manage_daily_news.py:144- Finding
Persistent Agent Prompt Injection Through Unvalidated News Topics
- Content
View full analysis
str: topic_text = "、".join(topics) prefix = "[TEST] " if test_mode else "" return ( f"{prefix}请为 QQ 用户 {to} 生成并投递一份今日新闻简报，主题：{topic_text}。" "先抓取当天相关新闻，再筛选、去重、整理为简洁中文简报。" "输出时直接给用户最终内容，不要解释过程，不要输出系统说明。" "每个主题 2 到 4 条，每条包含标题、来源、要点。" "如果是测试，只需要立即发出一份简洁可读的真实新闻简报即可。" ) ``` The resulting message is passed directly to the scheduled agent: ```python def create_cron_job(openclaw_cmd: str, *, to: str, topics: list[str], time_text: str, test_mode: bool = False) -> dict: timezone = ensure_timezone(to) at_value, cron_expr = resolve_schedule(time_text, timezone) name = build_content(topics) message = build_agent_message(to, topics, test_mode=test_mode) cmd = [ openclaw_cmd, "cron", "add", "--name", name, "--session", "isolated", "--message", message, "--channel", "qqbot", "--to", to, "--announce", "--json", ] ``` ### Technical Analysis The `--topics` argument accepts arbitrary strings. `normalize_topics()` only splits the value on commas and removes surrounding whitespace; it does not enforce an allowlist, maximum length, character restrictions, or a data-only format. `build_agent_message()` concatenates these topic values into the natural-language instruction sent to a future OpenClaw agent. Consequently, a topic can contain newlines or imperative text that the scheduled agent may interpret as additional instructions rather than as a news category. The use of a subprocess argument list prevents operating- ...[truncated 1609 chars]- Remediation
View remediation