360 Secure SkillHub
360 安全技能中心

Fabricated Symbols

针对代码中调用不存在符号的问题,列出症状(臆造第三方库方法、错误签名、引用项目没有的工具函数、运行时属性或类型错误)并给出应对方法:核对库真实 API 与类型定义、检索代码库确认符号存在、缺失时显式补充或改用现有实现、重构后运行类型检查。不包含自动扫描或修复脚本。

mvogt99
mvogt99
热度 45.54
最近更新 2026-05-11 17:45:50
分类:开发依赖:纯提示词应用场景:代码生成 / 调试排错

安装技能

复制下面的话术发给你的 Agent,它会通过 secure-skills 检索并安装该技能。

执行命令安装此 skill: npx secure-skills-cli add fabricated-symbols
Metadata
name
fabricated-symbols
description
Code calls functions, classes, or methods that don't exist — either on project types or on third-party library APIs.
emoji
👻
metadata
{"clawdis":{"os":["macos","linux","windows"]}}

fabricated-symbols

The agent invokes a symbol that isn't defined. Most often this is a plausible-looking method on a third-party object, or a utility "I'm sure we have one of those" that the project actually lacks.

Symptoms

  • Generated code calls someLibrary.convenientHelper(...) where the library has no such method.
  • Invented method signatures on framework objects (wrong argument order, wrong return type).
  • References to utility functions the project doesn't have.
  • Runtime AttributeError / TypeError: X is not a function / undefined is not a function.

What to do

  • For every symbol you invoke on a third-party library, check the library's real API — docs, source, or type definitions — before writing code.
  • For every symbol you invoke on a project type, grep the codebase to confirm it exists. Don't assume.
  • If a helper is missing, either add it explicitly (and say you're adding it) or use what the project actually has.
  • Prefer the library's documented API over clever-looking shortcuts. Invented methods often look like what the library "should" have.
  • When refactoring, run the type-checker after every meaningful change. Invented methods sometimes type-check against any but fail at runtime.