AI生成的Ansible代码常含安全缺陷，本文通过提示工程提升合规性。
Evaluating and Preventing Security Smells in AI-Generated Ansible Code
- 在提示中融合最佳实践与CIS标准，预防安全异味
- 4个模型达95%-100%合规，优于人类4倍
- 无需重训练，适配能力强，适合工具链集成
AI编程助手生成基础设施即代码，但尚无研究评估其是否满足安全要求。安全异味会传播至部署系统，导致不安全且不可信的基础设施。我们评估了16个AI模型生成的278个Ansible角色（用于Apache Tomcat v10和MongoDB v7），对照CIS基准分析，发现未提供安全指导时所有模型均产生含安全异味的代码，导致合规失败，性能低于人工编写。本文提出扩展CO-STAR框架，在提示中整合Ansible最佳实践与CIS基准，实现合成阶段的安全异味预防。应用该方法后，4个模型生成合规代码，最优模型达95%-100% CIS合规，是人类23%-43%的四倍；整体代码质量提升19%-49%。其余12个模型失败非因生成能力不足，而是无法遵循多约束指令。对具备能力的模型，该方法无需重训练，仅需调整系统提示即可应用。
原文摘要 · Abstract (English)
AI coding assistants generate Infrastructure as Code, yet no work has examined whether this code meets security requirements. This matters because security smells in infrastructure code propagate to deployed systems, producing infrastructure that is insecure and untrustworthy. We evaluate 16 AI models generating Ansible roles for Apache Tomcat v10 and MongoDB v7, analysing 278 Ansible roles against CIS benchmarks. Without security guidance, all 16 AI models produced code containing security smells, resulting in vulnerable infrastructure that fails compliance verification and underperforms code written by human developers. We introduce an approach integrating Ansible best practices and CIS benchmarks into prompts through an extended CO-STAR framework, enabling security smell prevention during synthesis rather than detection after deployment. When this approach is applied, 4 out of 16 models generate compliant code, with the leading model achieving 95%-100% CIS compliance, a fourfold improvement over humans at 23%-43%, with overall code quality improving by 19%-49%. The remaining 12 models fail not because they cannot generate code but because they cannot follow instructions with multiple constraints. For capable models, the approach requires no retraining and can be adopted through system prompts.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。