sdaduanbilei/cc-haha
1
0
Fork 0
mirror of https://github.com/NanmiCoder/cc-haha synced 2026-07-28 15:53:37 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: tighten skill risk key detection

Browse Source
This commit is contained in:
程序员阿江(Relakkes) 2026-07-03 18:15:20 +08:00
parent 000738442d
commit d24f0f4bda
2 changed files with 18 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
src/server/__tests__/skill-market.test.ts
View File

@ -715,6 +715,20 @@ describe('skill market risk analysis', () => {
expect(risk).toEqual(['requires-api-key']) expect(risk).toEqual(['requires-api-key'])
}) })
it('does not treat similarly named fields as allowed tools or hooks', () => {
const risk = analyzeSkillRisk({
entryContent: [
'---',
'disallowed-tools: Bash',
'webhooks: https://example.com/callback',
'---',
].join('\n'),
files: [],
})
expect(risk).toEqual(['external-network'])
})
it('returns an empty array when no conservative risks are detected', () => { it('returns an empty array when no conservative risks are detected', () => {
const risk = analyzeSkillRisk({ const risk = analyzeSkillRisk({
entryContent: 'A local-only skill with no special permissions.', entryContent: 'A local-only skill with no special permissions.',

7
src/server/services/skillMarket/risk.ts
View File

@ -11,6 +11,8 @@ const RISK_LABEL_ORDER: SkillMarketRiskLabel[] = [
const EXECUTABLE_EXTENSION = /\.(sh|bash|zsh|fish|ps1|cmd|bat|py|js|ts)$/i const EXECUTABLE_EXTENSION = /\.(sh|bash|zsh|fish|ps1|cmd|bat|py|js|ts)$/i
const API_KEYWORD = /api[\s_-]?key|token|secret/i const API_KEYWORD = /api[\s_-]?key|token|secret/i
const ALLOWED_TOOLS_KEY = /^\s*allowed-tools\s*:/m
const HOOKS_KEY = /^\s*hooks\s*:/m
export function analyzeSkillRisk(input: { export function analyzeSkillRisk(input: {
entryContent?: string entryContent?: string
@ -19,13 +21,12 @@ export function analyzeSkillRisk(input: {
}): SkillMarketRiskLabel[] { }): SkillMarketRiskLabel[] {
const labels = new Set<SkillMarketRiskLabel>() const labels = new Set<SkillMarketRiskLabel>()
const entryContent = input.entryContent ?? '' const entryContent = input.entryContent ?? ''
const entryLines = entryContent.split(/\r?\n/)
if (entryLines.some((line) => line.includes('allowed-tools:'))) { if (ALLOWED_TOOLS_KEY.test(entryContent)) {
labels.add('allowed-tools') labels.add('allowed-tools')
} }
if (entryLines.some((line) => line.includes('hooks:'))) { if (HOOKS_KEY.test(entryContent)) {
labels.add('hooks') labels.add('hooks')
} }