fix(knowledge): frame the video title and URL in the video-digest resume prompt as untrusted data
维护者通常 1 天内回复
已经有一个关联 PR 被合并了。
- #7088 来自 @kyle-sexton —— 已合并
评估
- 难度
- 2/5
- 预计耗时
- 1-3 小时
- 新手友好度
- 62/100
- Issue 类型
- 缺陷
- 描述清晰度
- 描述清楚
- 活跃度
- 活跃
- 技术栈
- javascript
调研方向
从 plugins/knowledge/skills/video-digest/extraction/watch/watch-state.js 中的 buildContinuationPrompt 开始，title 和 sourceUrl 在第 326 行和第 330 行附近被插值，并检查第 46-47 行的状态字段。阅读 docs/conventions/untrusted-content/README.md，以复用其中的框架结构。完成标准是：title 和 URL 位于带分隔符的数据块中，换行被合并，反引号被中和；标题不再包含原始标题；并且新测试表明，包含祈使句行和代码围栏的标题只会出现在该数据块内。
由索引模型根据 Issue 内容生成。
描述
Summary
buildContinuationPrompt in watch-state.js interpolates the video title and source URL straight into the resume prompt. Both come from the video's own metadata, which the video's publisher controls. The prompt is the text a fresh session reads as its instructions, and it is written into the slice, so a title carrying imperative text lands in the instruction channel with no data framing.
Failure scenario
Expected: ingested metadata is presented as data, never instructions, per the framing contract in docs/conventions/untrusted-content/README.md (classification, finding, authority floor).
Actual: the first line is # Continue /knowledge:video-digest watch — ${state.title} and a later line is Source: ${state.sourceUrl}, unquoted and unframed. A title such as one containing a sentence addressed to the agent reads, to the resuming session, as part of its own prompt. #6820 framed the ingested transcripts, comments and pages; this prompt is a separate ingest path that the fix did not cover.
Evidence
- Title in the prompt heading: https://github.com/melodic-software/claude-code-plugins/blob/7787be41e98e30cd6e3b82e99494886d77e30895/plugins/knowledge/skills/video-digest/extraction/watch/watch-state.js#L326
- Source URL in the prompt: https://github.com/melodic-software/claude-code-plugins/blob/7787be41e98e30cd6e3b82e99494886d77e30895/plugins/knowledge/skills/video-digest/extraction/watch/watch-state.js#L330
- The state fields the prompt reads (
sourceUrl,title): https://github.com/melodic-software/claude-code-plugins/blob/7787be41e98e30cd6e3b82e99494886d77e30895/plugins/knowledge/skills/video-digest/extraction/watch/watch-state.js#L46-L47 - Framing contract: https://github.com/melodic-software/claude-code-plugins/blob/7787be41e98e30cd6e3b82e99494886d77e30895/docs/conventions/untrusted-content/README.md
watch-state.jshas no untrusted-content wording on main (searched for "untrusted").
Suggested fix
Carry the inline framing spine from the untrusted-content convention in the prompt, move the title and URL into a clearly delimited data block (for example a fenced block, with newlines in the title collapsed and backticks neutralized), and keep the heading free of the raw title. Add a test that a title containing an imperative line and a code fence does not appear outside the data block.
Related
- #6820 (framed ingested transcripts, comments and pages)
- docs/conventions/untrusted-content/README.md
🤖 Generated with Claude Code
- 主要语言
- Shell
- 星标
- 22
- 派生
- 2
- 平均合并
- 7 小时 42 分钟
- 30 天内合并 PR
- 923
环境准备
- 没有 Dockerfile 或 Docker Compose 文件
- 没有 Pull Request 模板
- 阅读贡献指南
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
melodic-software/claude-code-plugins 的其他 Issue
-
priority: medium
难度 2/5 1-3 小时 新手友好度 68/100
melodic-software/claude-code-plugins#7351 · 2 条评论 ·
维护者通常 1 天内回复
-
priority: high
难度 2/5 1-3 小时 新手友好度 74/100
melodic-software/claude-code-plugins#7312 · 2 条评论 ·
维护者通常 1 天内回复
-
priority: medium
难度 2/5 1-3 小时 新手友好度 76/100
melodic-software/claude-code-plugins#7288 · 2 条评论 ·
维护者通常 1 天内回复
-
knowledge: docpage-digest dual verification defines no verdict vocabulary or pass/fail threshold未关闭needs-human
难度 2/5 1-3 小时 新手友好度 78/100
melodic-software/claude-code-plugins#7286 · 2 条评论 ·
维护者通常 1 天内回复
-
priority: low
难度 2/5 1-3 小时 新手友好度 76/100
melodic-software/claude-code-plugins#7282 · 2 条评论 ·
维护者通常 1 天内回复
查看 melodic-software/claude-code-plugins 的全部 Issue
相似的 Issue
-
Laptop display stays disabled after unplugging external monitor: FALLBACK output counted as external未关闭
难度 2/5 1-3 小时 新手友好度 79/100
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 82/100
-
[Bug]: Three default prefs with JSON values are never set (override.sh escapes their quotes twice)未关闭bug
难度 2/5 1-3 小时 新手友好度 78/100
Floorp-Projects/Floorp#2913 ·
维护者通常 1 天内回复
-
agent-butler-finding agent-research-recommend bug ready-for-agent
难度 2/5 1-3 小时 新手友好度 82/100
jordansmall/spindrift#5258 · 1 条评论 ·
维护者通常 1 天内回复
-
enhancement good first issue
难度 2/5 1-3 小时 新手友好度 78/100
维护者通常 1 天内回复