I submitted a side-project extension for review and an AI bot found 4 real security bugs in it

说明与用途

自动审查器在 Raycast 扩展中发现四个安全漏洞：未转义的 HTML、Markdown 注入、空项目导致崩溃以及文件覆盖。通过添加清理和检查修复了这些问题。

问题

A Raycast extension that renders invoice JSON into HTML/Markdown preview contained four security bugs discovered by an automated reviewer.

结果

Four security vulnerabilities were identified and fixed: unescaped HTML, Markdown injection, null item crash, and silent file overwrite.

工作流

• 1. Paste invoice JSON into extension
• 2. Render HTML/Markdown preview
• 3. Save preview to file

证据

Within a few minutes, an automated reviewer (Greptile, which Raycast runs on every incoming PR) left 9 comments. Four were tagged P1/security.

来源

Paste "tax_rate": "0"><script>alert(1)</script>" and it reaches the HTML template unescaped

来源

A notes value like  turns into an image markdown tag that fires a real HTTP request

来源

Two invoices with numbers like INV/001 and INV:001 both sanitize to the same filename. Saving the second one silently overwrote the first

来源